Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1505363
MD5:03c318cdb19ab95c6214de1d5bfef1df
SHA1:758363dc892672552731c4bfe52485a60d933312
SHA256:5ceb5d0c9157680c45f09c037d1c579824821a9b26593ffef8239b5a0ed7e96a
Tags:exe
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 5248 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 03C318CDB19AB95C6214DE1D5BFEF1DF)
    • msedge.exe (PID: 6976 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 7208 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2020,i,2576952469324847178,13305094956544838647,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • firefox.exe (PID: 5496 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • firefox.exe (PID: 5856 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 7092 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8236 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2248 -parentBuildID 20230927232528 -prefsHandle 2180 -prefMapHandle 2160 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9226e162-6336-4180-a447-236efcf9b96e} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2240a36e510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 7372 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -parentBuildID 20230927232528 -prefsHandle 4280 -prefMapHandle 3920 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {492a3418-b3b9-49ea-8fda-7229f54742bd} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2241d32cc10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • msedge.exe (PID: 7336 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7716 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 9056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7008 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 9088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7156 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 9360 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4964 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 9376 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7960 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 9628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=8148 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 10200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=8128 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: file.exeReversingLabs: Detection: 26%
Source: file.exeVirustotal: Detection: 29%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for sample
Source: file.exeJoe Sandbox ML: detected
Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.222.236.48:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.222.236.48:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.dr
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.dr
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_007DDBBE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007AC2A2 FindFirstFileExW,0_2_007AC2A2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E68EE FindFirstFileW,FindClose,0_2_007E68EE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_007E698F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_007DD076
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_007DD3A9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_007E9642
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_007E979D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_007E9B2B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_007E5C97
Source: Joe Sandbox ViewIP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox ViewIP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox ViewIP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox ViewIP Address: 23.219.161.132 23.219.161.132
Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox ViewJA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.41.14
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007ECE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_007ECE44
Source: global trafficHTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1264983581&timestamp=1725593762981 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726198560&P2=404&P3=2&P4=N4ca5ZcfSGhJ5Pwwpq4arg18zjS6DdIPQzhglCHhlbgc05jprPBqHuMmtEztXM9sul%2b7TDqpNoKFeDLFIvctgA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: AHnfzUw9D9vLWxoi2gC2plSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ProductCategoriesSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RVwYmNT3spD2U6f&MD=aTXgpPoz HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RVwYmNT3spD2U6f&MD=aTXgpPoz HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: 000003.log6.8.drString found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.8.drString found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.8.drString found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000003.2356561087.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2453047376.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE0F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000006.00000003.2179783061.000002241BFBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2121591854.000002241BFBB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000002.3267999239.000002241775D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000006.00000002.3267999239.000002241775D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: color-mix(in srgb, currentColor 9%, transparent)resource://search-extensions/google/amazondotcom%40search.mozilla.org:1.6--panel-banner-item-update-supported-bgcolorresource://search-extensions/amazondotcom/resource://search-extensions/wikipedia/--autocomplete-popup-separator-color*://vast.adsafeprotected.com/vast**://www.facebook.com/platform/impression.php*--panel-banner-item-info-icon-bgcolorFormHistory:AutoCompleteSearchAsync equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000003.2229144158.00000224192EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183277788.00000224192E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3274203132.00000224192EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000006.00000003.2229144158.00000224192EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183277788.00000224192E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3274203132.00000224192EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttps://poczta.interia.pl/mh/?mailto=%shandlerSvc fillHandlerInfo: don't know this typegecko.handlerService.defaultHandlersVersionhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/web-handler-app;1get FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIUPDATE_SERVICE_MANUALLY_UNINSTALLED_ equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/play.svg*://www.everestjs.net/static/st.v3.js*@mozilla.org/addons/addon-manager-startup;1*://track.adform.net/serving/scripts/trackpoint/FileUtils_closeSafeFileOutputStream*://static.chartbeat.com/js/chartbeat.js*://static.chartbeat.com/js/chartbeat_video.jswebcompat-reporter%40mozilla.org:1.5.1*://connect.facebook.net/*/all.js*pictureinpicture%40mozilla.org:1.0.0*://connect.facebook.net/*/sdk.js**://www.google-analytics.com/analytics.js**://www.googletagmanager.com/gtm.js**://ssl.google-analytics.com/ga.js*://pub.doubleverify.com/signals/pub.js**://imasdk.googleapis.com/js/sdkloader/ima3.js*://*.imgur.io/js/vendor.*.bundle.js*://www.googletagservices.com/tag/js/gpt.js**://*.imgur.com/js/vendor.*.bundle.js*://web-assets.toggl.com/app/assets/scripts/*.js*://www.google-analytics.com/plugins/ua/ec.jsFileUtils_closeAtomicFileOutputStream*://cdn.branch.io/branch-latest.min.js**://static.criteo.net/js/ld/publishertag.js*://www.rva311.com/static/js/main.*.chunk.js*://auth.9c9media.ca/auth/main.js*://www.google-analytics.com/gtm/js**://c.amazon-adsystem.com/aax2/apstag.js*://libs.coremetrics.com/eluminate.js*://s0.2mdn.net/instream/html5/ima3.jshttps://smartblock.firefox.etp/facebook.svgwebcompat-reporter@mozilla.org.xpiAlso failed to remove the update messages log: equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000003.2179783061.000002241BFBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2121591854.000002241BFBB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000003.2228561697.000002241AEFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BF93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BFD9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: c5ab0441-99c3-4bd1-81d2-d6aa992ad438.tmp.9.drString found in binary or memory: {"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659357526057","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659360139420","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13370160961312946","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659362135372","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659364204848","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",true],"server":"https://accounts.youtube.com"},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659365905310","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://www.google.com"},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659365178637","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"network_stats":{"srtt":304487},"server":"https://www.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659365886504","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"network_stats":{"srtt":231954},"server":"https://accounts.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659395206168","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://play.google.com"}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}} equals www.youtube.com (Youtube)
Source: b8647186-267b-4d12-be57-7d285fafded7.tmp.9.drString found in binary or memory: {"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659357526057","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659360139420","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13370160961312946","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659362135372","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659364204848","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",true],"server":"https://accounts.youtube.com"},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659365905310","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://www.google.com"},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659365178637","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"network_stats":{"srtt":304487},"server":"https://www.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659365886504","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"network_stats":{"srtt":231954},"server":"https://accounts.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659395206168","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://play.google.com"}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}} equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: bzib.nelreports.net
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global trafficDNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global trafficDNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: detectportal.firefox.com
Source: global trafficDNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: example.org
Source: global trafficDNS traffic detected: DNS query: ipv4only.arpa
Source: global trafficDNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global trafficDNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: services.addons.mozilla.org
Source: global trafficDNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: firefox.exe, 00000006.00000003.2452940301.000002241AE59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2356165756.000002241AE59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183063589.000002241AE59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3260906891.000002240A36D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 00000006.00000003.2453865643.00000224192A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org
Source: firefox.exe, 00000006.00000003.2454238820.0000022419279000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-aarch64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zi
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-arm-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86_64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-linux32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2.zip
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000006.00000003.2452940301.000002241AE59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3273497449.0000022419299000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2453898914.0000022419299000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454819530.000002241CC33000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000006.00000003.2454819530.000002241CC33000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zipjar:file:
Source: firefox.exe, 00000006.00000003.2452070709.000002241BA44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000006.00000002.3266205712.000002241707D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://e.mai
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: firefox.exe, 00000006.00000003.2392118513.000002241D89A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000006.00000003.2453865643.00000224192A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000006.00000003.2355975429.000002241B33C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000006.00000003.2453865643.00000224192A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2452836446.000002241AE87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000006.00000003.2453865643.00000224192A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000006.00000003.2231616916.0000022416A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416A8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000006.00000002.3264109996.0000022416A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416A81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000006.00000003.2231616916.0000022416A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416A8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000006.00000002.3264109996.0000022416A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416A81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000006.00000003.2231616916.0000022416A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416A8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000006.00000002.3260906891.000002240A303000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 00000006.00000003.2119352142.000002241D3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2106332384.000002241D4F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2452157787.000002241BA26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2118257131.000002241D4F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2830798526.000002241B43C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2175324467.000002241E508000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2451908889.000002241BC1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2118257131.000002241D4A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2393460083.000002241D3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2083959242.000002241A9F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2106332384.000002241D4A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2710527772.000002241D3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2226624543.000002241D36B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2175135103.000002241E533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2162411167.000002241A9F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2178299452.000002241D4F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2390918180.000002241A9FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2227730122.000002241BC1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2175061597.000002241E557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2182387324.000002241AF0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2829218127.000002241B137000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000006.00000003.2392118513.000002241D89A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000006.00000002.3266205712.000002241707D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjsbrowser.fixup.do
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000006.00000002.3266205712.000002241707D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttps://poczta.interia.pl/mh/?mailto=%shandlerSvc
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000006.00000003.2392118513.000002241D89A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000006.00000002.3267999239.0000022417725000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000006.00000003.2182387324.000002241AF0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417725000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2355908445.000002241BCA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241779A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2181131576.000002241BCA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179043279.000002241D445000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2181874837.000002241B36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179159277.000002241D41A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:scope
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/notifi
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/toolba
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuloncommand=closebuttoncommand
Source: firefox.exe, 00000006.00000002.3267999239.0000022417743000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://builtin-themes/colorways/202
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/BrowserTelemetry
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulwindow.arguments
Source: mozilla-temp-41.6.drString found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000006.00000002.3275018478.000002241A870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000003.2061482795.000002241B183000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2061278974.000002241B16B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2058342916.000002241AF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060619392.000002241B136000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2061009309.000002241B150000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060245272.000002241B11C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/https://www.google.com/searchLOAD_ANONYMOUS_ALLOW_CLIENT_CERT__instrume
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000006.00000003.2118257131.000002241D4A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2106332384.000002241D4A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2393269103.000002241D4A6000.00000004.00000800.00020000.00000000.sdmp, Session_13370067357758337.8.drString found in binary or memory: https://accounts.google.com
Source: MediaDeviceSalts.8.dr, 000003.log2.8.dr, Session_13370067357758337.8.drString found in binary or memory: https://accounts.google.com/
Source: MediaDeviceSalts.8.drString found in binary or memory: https://accounts.google.com//
Source: History.8.drString found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/v3/signin/challeng
Source: firefox.exe, 00000010.00000002.3252996181.0000027D1B43A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Service
Source: firefox.exe, 00000010.00000002.3254281009.0000027D1B7D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.goog
Source: Session_13370067357758337.8.drString found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.co
Source: Session_13370067357758337.8.drString found in binary or memory: https://accounts.google.com/_/bscframe
Source: Favicons.8.drString found in binary or memory: https://accounts.google.com/favicon.ico
Source: firefox.exe, 0000000B.00000002.3255419441.000001EF9930A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/p-
Source: file.exe, 00000000.00000003.2001758376.000000000169B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2002430311.00000000016A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2001621435.00000000016A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2001621435.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2001758376.00000000016A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2002430311.000000000169B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2001758376.0000000001679000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2002430311.000000000167A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000003.00000003.2004524173.00000149AE8AD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000003.00000002.2006147631.00000149AE8B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: file.exe, 00000000.00000002.2002430311.00000000016A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2001621435.00000000016A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2001758376.00000000016A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdJ
Source: Session_13370067357758337.8.drString found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2Fv3%2Fs
Source: 000003.log2.8.drString found in binary or memory: https://accounts.youtube.com/
Source: Session_13370067357758337.8.drString found in binary or memory: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1264
Source: firefox.exe, 00000006.00000003.2183277788.00000224192C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000006.00000003.2228561697.000002241AEFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BF93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BFD9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2182440447.000002241AEF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ads.stickyadstv.com/firefox-etpresource://gre/modules/FormHistory.sys.mjs
Source: firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://amazon.com
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357194591.00000224187F4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000006.00000003.2454670900.0000022418726000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000006.00000003.2453898914.0000022419299000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/GMP/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release/Win
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000006.00000003.2453898914.0000022419299000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/re
Source: firefox.exe, 00000006.00000002.3260906891.000002240A30E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000006.00000003.2183201274.000002241AE47000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180use
Source: Reporting and NEL.9.drString found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.8.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.8.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.8.drString found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.8.drString found in binary or memory: https://chromewebstore.google.com/
Source: b8647186-267b-4d12-be57-7d285fafded7.tmp.9.dr, c5ab0441-99c3-4bd1-81d2-d6aa992ad438.tmp.9.drString found in binary or memory: https://clients2.google.com
Source: manifest.json.8.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36
Source: firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drString found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000006.00000002.3260906891.000002240A30E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3260906891.000002240A332000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: Reporting and NEL.9.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/AccountsSignInUi
Source: Reporting and NEL.9.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.9.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers
Source: Reporting and NEL.9.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: manifest.json.8.drString found in binary or memory: https://docs.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.8.drString found in binary or memory: https://drive.google.com/
Source: firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000006.00000003.2230961304.0000022418758000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357307954.0000022418728000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3275018478.000002241A870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000003.2061482795.000002241B183000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.0000022418726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2061278974.000002241B16B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2058342916.000002241AF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060619392.000002241B136000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2061009309.000002241B150000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060245272.000002241B11C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.0000022418726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.0000022418728000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
Source: Web Data.8.drString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.8.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.8.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2167851278.0000022418877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230701221.00000224187D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2832300800.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3271651490.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3266205712.000002241707D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: 000003.log6.8.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.8.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.8.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.8.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log6.8.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 000003.log8.8.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/product_category_en/1.0.0/asset?assetgroup=ProductCate
Source: 000003.log6.8.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2167851278.0000022418877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230701221.00000224187D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2832300800.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3271651490.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sWebExtensions
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000006.00000002.3267999239.0000022417743000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267263818.0000022417610000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 00000006.00000003.2357109249.0000022419279000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expe
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1CookieService::Add
Source: b8647186-267b-4d12-be57-7d285fafded7.tmp.9.dr, c5ab0441-99c3-4bd1-81d2-d6aa992ad438.tmp.9.drString found in binary or memory: https://fonts.gstatic.com
Source: firefox.exe, 00000006.00000003.2230621325.00000224187D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000006.00000002.3260906891.000002240A36D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com0
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000006.00000002.3275018478.000002241A870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000003.2061278974.000002241B16B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2058342916.000002241AF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060619392.000002241B136000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2061009309.000002241B150000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060245272.000002241B11C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshotsextension/screenshots
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 00000006.00000002.3267263818.0000022417610000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3260906891.000002240A30E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881SessionF
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://ideas.mozilla.org/
Source: prefs-1.js.6.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000006.00000003.2183277788.00000224192D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.00000224177EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000006.00000003.2452763985.000002241AED1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2182440447.000002241AED1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000006.00000003.2357109249.0000022419279000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000006.00000003.2841772925.00001362F5203000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: firefox.exe, 00000006.00000003.2841772925.00001362F5203000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.comZ
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2167851278.0000022418877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230701221.00000224187D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2832300800.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3271651490.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3266205712.000002241707D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%sresource://gre/modules/UpdateService.sys.mjs
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2167851278.0000022418877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230701221.00000224187D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2832300800.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3271651490.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3266205712.000002241707D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/ExtHandlerService.sys.mjsextension/bin
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF99672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B88E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000006.00000003.2231463597.00000224176B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://monitor.firefox.comhttps://screenshots.firefox.comhttps://addons.mozilla.orgcreateContentPri
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2167851278.0000022418877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230701221.00000224187D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2832300800.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3271651490.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%shttps://mail.google.com/mail/?extsrc=mailto&u
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2167851278.0000022418877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230701221.00000224187D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2832300800.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3271651490.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3266205712.000002241707D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sbrowser.download.viewableInternally.extension/bing
Source: firefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://profiler.firefox.combrowserToolboxLauncherConfigprofilerRecordingButtonCreatedtoggleProfiler
Source: firefox.exe, 00000006.00000003.2453553395.00000224192B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2452785867.000002241AEAE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com
Source: firefox.exe, 00000006.00000003.2454670900.0000022418726000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/
Source: firefox.exe, 00000006.00000003.2452836446.000002241AE87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000006.00000003.2183277788.00000224192C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2356219495.000002241AE56000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/shims/rambler-authenticator.js
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/shims/rambler-authenticator.js/shims/mochitest-shim-2.js
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000006.00000003.2357641289.000002241CC33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000006.00000003.2357641289.000002241CC33000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%Take
Source: firefox.exe, 00000006.00000003.2453047376.000002241AE17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/facebook.svgwebcompat-reporter
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BFFC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000006.00000003.2121591854.000002241BFFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BF93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BFD9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BFFC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelUpdateServiceStub:UpdateServiceStub
Source: firefox.exe, 00000006.00000003.2183277788.00000224192C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000006.00000002.3267263818.0000022417610000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000006.00000002.3267999239.00000224177EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000006.00000002.3267999239.00000224177EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000006.00000002.3267999239.00000224177EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/website-translation.unified-extensions-context-menu-management-separa
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.orghttps://truecolors.firefox.com_migrateXULStoreForDocumentbookmarksToolbar
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000006.00000003.2183277788.00000224192C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000006.00000003.2356561087.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2453047376.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2228787897.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417743000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/resource:///modules/UrlbarProviderHeuristicFallba
Source: firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drString found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drString found in binary or memory: https://www.digicert.com/CPS0
Source: content_new.js.8.dr, content.js.8.drString found in binary or memory: https://www.google.com/chrome
Source: firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: Web Data.8.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/policies/privacy/findUpdates()
Source: firefox.exe, 00000006.00000002.3275018478.000002241A870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000003.2061482795.000002241B183000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2061278974.000002241B16B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2058342916.000002241AF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060619392.000002241B136000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2061009309.000002241B150000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060245272.000002241B11C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267263818.0000022417610000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417743000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
Source: b8647186-267b-4d12-be57-7d285fafded7.tmp.9.dr, c5ab0441-99c3-4bd1-81d2-d6aa992ad438.tmp.9.drString found in binary or memory: https://www.googleapis.com
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000006.00000002.3267263818.0000022417610000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3260906891.000002240A36D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000006.00000002.3264109996.0000022416A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8BC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000006.00000002.3260906891.000002240A36D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.orginner-window-destroyed
Source: firefox.exe, 00000006.00000002.3256948735.00000089FC3FC000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000006.00000003.2841772925.00001362F5203000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000006.00000002.3265207142.0000022416BD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000006.00000003.2356561087.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2453047376.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2228787897.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000006.00000003.2841772925.00001362F5203000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.widevine.com/browser.sessionstore.idleDelay
Source: firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3274203132.00000224192EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.222.236.48:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.222.236.48:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007EEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_007EEAFF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007EED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_007EED6A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007EEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_007EEAFF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_007DAA57
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00809576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00809576

System Summary

barindex
Binary is likely a compiled AutoIt script file
Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1996343032.0000000000832000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_36b54967-a
Source: file.exe, 00000000.00000000.1996343032.0000000000832000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_5cc62c44-1
Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_2c4a6148-4
Source: file.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_80fe9551-5
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_0000027D1BF18777 NtQuerySystemInformation,16_2_0000027D1BF18777
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_0000027D1C37B432 NtQuerySystemInformation,16_2_0000027D1C37B432
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DD5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_007DD5EB
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007D1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_007D1201
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_007DE8F6
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007780600_2_00778060
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E20460_2_007E2046
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007D82980_2_007D8298
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007AE4FF0_2_007AE4FF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007A676B0_2_007A676B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_008048730_2_00804873
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0077CAF00_2_0077CAF0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0079CAA00_2_0079CAA0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0078CC390_2_0078CC39
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007A6DD90_2_007A6DD9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0078B1190_2_0078B119
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007791C00_2_007791C0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007913940_2_00791394
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007917060_2_00791706
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0079781B0_2_0079781B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0078997D0_2_0078997D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007779200_2_00777920
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007919B00_2_007919B0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00797A4A0_2_00797A4A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00791C770_2_00791C77
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00797CA70_2_00797CA7
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007FBE440_2_007FBE44
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007A9EEE0_2_007A9EEE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00791F320_2_00791F32
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_0000027D1BF1877716_2_0000027D1BF18777
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_0000027D1C37B43216_2_0000027D1C37B432
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_0000027D1C37BB5C16_2_0000027D1C37BB5C
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_0000027D1C37B47216_2_0000027D1C37B472
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00790A30 appears 46 times
Source: C:\Users\user\Desktop\file.exeCode function: String function: 0078F9F2 appears 40 times
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00779CB3 appears 31 times
Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engineClassification label: mal64.evad.winEXE@71/269@30/22
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E37B5 GetLastError,FormatMessageW,0_2_007E37B5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007D10BF AdjustTokenPrivileges,CloseHandle,0_2_007D10BF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007D16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_007D16C3
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_007E51CD
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,0_2_007DD4DC
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_007E648E
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007742A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_007742A2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d61d9463-20aa-4a59-92e4-afaa36feb075.tmpJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Local\Temp\firefoxJump to behavior
Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: file.exeReversingLabs: Detection: 26%
Source: file.exeVirustotal: Detection: 29%
Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2020,i,2576952469324847178,13305094956544838647,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2248 -parentBuildID 20230927232528 -prefsHandle 2180 -prefMapHandle 2160 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9226e162-6336-4180-a447-236efcf9b96e} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2240a36e510 socket
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7008 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7156 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -parentBuildID 20230927232528 -prefsHandle 4280 -prefMapHandle 3920 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {492a3418-b3b9-49ea-8fda-7229f54742bd} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2241d32cc10 rdd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4964 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7960 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=8148 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=8128 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2020,i,2576952469324847178,13305094956544838647,262144 /prefetch:3Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2248 -parentBuildID 20230927232528 -prefsHandle 2180 -prefMapHandle 2160 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9226e162-6336-4180-a447-236efcf9b96e} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2240a36e510 socketJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -parentBuildID 20230927232528 -prefsHandle 4280 -prefMapHandle 3920 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {492a3418-b3b9-49ea-8fda-7229f54742bd} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2241d32cc10 rddJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:3Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7008 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7156 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -parentBuildID 20230927232528 -prefsHandle 4280 -prefMapHandle 3920 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {492a3418-b3b9-49ea-8fda-7229f54742bd} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2241d32cc10 rddJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4964 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7960 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=8148 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=8128 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.dr
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.dr
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_007742DE
Source: gmpopenh264.dll.tmp.6.drStatic PE information: section name: .rodata
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00790A76 push ecx; ret 0_2_00790A89
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpJump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)Jump to dropped file
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0078F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_0078F98E
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00801C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00801C41
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\Desktop\file.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-96490
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_0000027D1BF18777 rdtsc 16_2_0000027D1BF18777
Source: C:\Users\user\Desktop\file.exeAPI coverage: 3.2 %
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_007DDBBE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007AC2A2 FindFirstFileExW,0_2_007AC2A2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E68EE FindFirstFileW,FindClose,0_2_007E68EE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_007E698F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_007DD076
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_007DD3A9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_007E9642
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_007E979D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_007E9B2B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_007E5C97
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_007742DE
Source: firefox.exe, 0000000B.00000002.3255419441.000001EF9930A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWPo3
Source: Web Data.8.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.8.drBinary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.drBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.drBinary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: firefox.exe, 00000006.00000003.2045346422.000002240C6C5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3262315464.000002240C6B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3259892902.000001EF99C40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255419441.000001EF9930A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3252996181.0000027D1B43A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: firefox.exe, 00000006.00000002.3265207142.0000022416BC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3258893563.000001EF9981F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: Web Data.8.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.drBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: firefox.exe, 00000010.00000002.3257726252.0000027D1BC90000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWj
Source: Web Data.8.drBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: Web Data.8.drBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.8.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.drBinary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.drBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 00000006.00000002.3262315464.000002240C70B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2045346422.000002240C70A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3259892902.000001EF99C40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255419441.000001EF9930A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3257726252.0000027D1BC90000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.8.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.drBinary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.drBinary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.drBinary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.drBinary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.drBinary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.drBinary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2001758376.000000000167F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Web Data.8.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.drBinary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.drBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Web Data.8.drBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: firefox.exe, 00000010.00000002.3257726252.0000027D1BC90000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW}
Source: Web Data.8.drBinary or memory string: bankofamerica.comVMware20,11696428655x
Source: Web Data.8.drBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_0000027D1BF18777 rdtsc 16_2_0000027D1BF18777
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007EEAA2 BlockInput,0_2_007EEAA2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007A2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_007A2622
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_007742DE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00794CE8 mov eax, dword ptr fs:[00000030h]0_2_00794CE8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007D0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_007D0B62
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007A2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_007A2622
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0079083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0079083F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007909D5 SetUnhandledExceptionFilter,0_2_007909D5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00790C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00790C21
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007D1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_007D1201
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007B2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_007B2BA5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007DB226 SendInput,keybd_event,0_2_007DB226
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007F22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_007F22DA
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007D0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_007D0B62
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007D1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_007D1663
Source: file.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exeBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00790698 cpuid 0_2_00790698
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007E8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_007E8195
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007CD27A GetUserNameW,0_2_007CD27A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007AB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,0_2_007AB952
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_007742DE
Source: file.exeBinary or memory string: WIN_81
Source: file.exeBinary or memory string: WIN_XP
Source: file.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exeBinary or memory string: WIN_XPe
Source: file.exeBinary or memory string: WIN_VISTA
Source: file.exeBinary or memory string: WIN_7
Source: file.exeBinary or memory string: WIN_8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007F1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_007F1204
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_007F1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_007F1806

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure2
Valid Accounts		1
Native API		1
DLL Side-Loading		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		21
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		2
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault AccountsScheduled Task/Job2
Valid Accounts		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol21
Input Capture		11
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)2
Valid Accounts		2
Obfuscated Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin Shares3
Clipboard Data		3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
Access Token Manipulation		1
DLL Side-Loading		NTDS15
System Information Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script12
Process Injection		1
Masquerading		LSA Secrets131
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
Valid Accounts		Cached Domain Credentials1
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
Virtualization/Sandbox Evasion		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
Access Token Manipulation		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1505363 Sample: file.exe Startdate: 06/09/2024 Architecture: WINDOWS Score: 64 42 telemetry-incoming.r53-2.services.mozilla.com 2->42 44 services.addons.mozilla.org 2->44 46 11 other IPs or domains 2->46 64 Multi AV Scanner detection for submitted file 2->64 66 Binary is likely a compiled AutoIt script file 2->66 68 Machine Learning detection for sample 2->68 70 AI detected suspicious sample 2->70 8 file.exe 1 2->8         started        11 msedge.exe 28 403 2->11         started        14 firefox.exe 1 2->14         started        signatures3 process4 dnsIp5 72 Binary is likely a compiled AutoIt script file 8->72 74 Found API chain indicative of sandbox detection 8->74 16 msedge.exe 10 8->16         started        18 firefox.exe 1 8->18         started        60 192.168.2.5, 443, 49484, 49703 unknown unknown 11->60 62 239.255.255.250 unknown Reserved 11->62 20 msedge.exe 11->20         started        23 msedge.exe 11->23         started        25 msedge.exe 11->25         started        30 4 other processes 11->30 27 firefox.exe 3 93 14->27         started        signatures6 process7 dnsIp8 32 msedge.exe 16->32         started        48 13.107.246.40, 443, 49743, 49746 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 20->48 50 ssl.bingadsedgeextension-prod-europe.azurewebsites.net 94.245.104.56, 443, 49712 MICROSOFT-CORP-MSN-AS-BLOCKUS United Kingdom 20->50 56 13 other IPs or domains 20->56 52 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49741, 49747, 49770 GOOGLEUS United States 27->52 54 telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123, 443, 49780, 49781 GOOGLEUS United States 27->54 58 5 other IPs or domains 27->58 38 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 27->38 dropped 40 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 27->40 dropped 34 firefox.exe 27->34         started        36 firefox.exe 27->36         started        file9 process10

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
file.exe26%ReversingLabs
file.exe29%VirustotalBrowse
file.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
example.org0%VirustotalBrowse
chrome.cloudflare-dns.com0%VirustotalBrowse
prod.balrog.prod.cloudops.mozgcp.net0%VirustotalBrowse
prod.classify-client.prod.webservices.mozgcp.net0%VirustotalBrowse
services.addons.mozilla.org0%VirustotalBrowse
prod.detectportal.prod.cloudops.mozgcp.net0%VirustotalBrowse
ipv4only.arpa0%VirustotalBrowse
prod.remote-settings.prod.webservices.mozgcp.net0%VirustotalBrowse
ssl.bingadsedgeextension-prod-europe.azurewebsites.net0%VirustotalBrowse
detectportal.firefox.com0%VirustotalBrowse
googlehosted.l.googleusercontent.com0%VirustotalBrowse
bzib.nelreports.net0%VirustotalBrowse
telemetry-incoming.r53-2.services.mozilla.com0%VirustotalBrowse
firefox.settings.services.mozilla.com0%VirustotalBrowse
clients2.googleusercontent.com0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.0%URL Reputationsafe
https://csp.withgoogle.com/csp/report-to/apps-themes0%URL Reputationsafe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing0%URL Reputationsafe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s0%URL Reputationsafe
https://bzib.nelreports.net/api/report?cat=bingbusiness0%URL Reputationsafe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref0%URL Reputationsafe
https://www.tsn.ca0%URL Reputationsafe
https://csp.withgoogle.com/csp/report-to/AccountsSignInUi0%URL Reputationsafe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-0%Avira URL Cloudsafe
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l0%Avira URL Cloudsafe
https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e40%Avira URL Cloudsafe
http://detectportal.firefox.com/0%Avira URL Cloudsafe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%0%Avira URL Cloudsafe
http://www.mozilla.com00%Avira URL Cloudsafe
https://smartblock.firefox.etp/facebook.svgwebcompat-reporter0%Avira URL Cloudsafe
https://www.google.com/policies/privacy/findUpdates()0%Avira URL Cloudsafe
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records0%Avira URL Cloudsafe
https://merino.services.mozilla.com/api/v1/suggest0%Avira URL Cloudsafe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect0%Avira URL Cloudsafe
https://spocs.getpocket.com/spocs0%Avira URL Cloudsafe
https://docs.google.com/0%Avira URL Cloudsafe
https://screenshots.firefox.com0%Avira URL Cloudsafe
https://completion.amazon.com/search/complete?q=0%Avira URL Cloudsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report0%Avira URL Cloudsafe
https://ads.stickyadstv.com/firefox-etp0%Avira URL Cloudsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab0%Avira URL Cloudsafe
https://monitor.firefox.com/breach-details/0%Avira URL Cloudsafe
https://screenshots.firefox.com/shims/rambler-authenticator.js0%Avira URL Cloudsafe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM0%Avira URL Cloudsafe
https://xhr.spec.whatwg.org/#sync-warning0%Avira URL Cloudsafe
https://www.amazon.com/exec/obidos/external-search/0%Avira URL Cloudsafe
https://profiler.firefox.com/0%Avira URL Cloudsafe
https://www.msn.com0%Avira URL Cloudsafe
https://github.com/mozilla-services/screenshots0%Avira URL Cloudsafe
https://services.addons.mozilla.org/api/v4/addons/addon/0%Avira URL Cloudsafe
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180use0%Avira URL Cloudsafe
http://exslt.org/sets0%Avira URL Cloudsafe
https://tracking-protection-issues.herokuapp.com/new0%Avira URL Cloudsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report0%Avira URL Cloudsafe
https://ac.duckduckgo.com/ac/https://www.google.com/searchLOAD_ANONYMOUS_ALLOW_CLIENT_CERT__instrume0%Avira URL Cloudsafe
https://accounts.youtube.com/0%Avira URL Cloudsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report0%Avira URL Cloudsafe
https://api.accounts.firefox.com/v10%Avira URL Cloudsafe
http://exslt.org/common0%Avira URL Cloudsafe
https://drive-daily-2.corp.google.com/0%Avira URL Cloudsafe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.360%Avira URL Cloudsafe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/0%Avira URL Cloudsafe
https://fpn.firefox.com0%Avira URL Cloudsafe
https://www.widevine.com/0%Avira URL Cloudsafe
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections0%Avira URL Cloudsafe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
http://exslt.org/dates-and-times0%Avira URL Cloudsafe
http://ocsp.rootca1.amazontrust.com0:0%Avira URL Cloudsafe
https://drive-daily-1.corp.google.com/0%Avira URL Cloudsafe
https://www.youtube.com/0%Avira URL Cloudsafe
https://drive-daily-5.corp.google.com/0%Avira URL Cloudsafe
https://www.google.com/favicon.ico0%Avira URL Cloudsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield0%Avira URL Cloudsafe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=0%Avira URL Cloudsafe
http://127.0.0.1:0%Avira URL Cloudsafe
https://bugzilla.mo0%Avira URL Cloudsafe
https://mitmdetection.services.mozilla.com/0%Avira URL Cloudsafe
https://amazon.com0%Avira URL Cloudsafe
https://static.adsafeprotected.com/firefox-etp-js0%Avira URL Cloudsafe
https://chromewebstore.google.com/0%Avira URL Cloudsafe
https://drive-preprod.corp.google.com/0%Avira URL Cloudsafe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde74770%Avira URL Cloudsafe
https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/ExtHandlerService.sys.mjsextension/bin0%Avira URL Cloudsafe
https://chrome.google.com/webstore/0%Avira URL Cloudsafe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture0%Avira URL Cloudsafe
https://spocs.getpocket.com/0%Avira URL Cloudsafe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/0%Avira URL Cloudsafe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%0%Avira URL Cloudsafe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f0%Avira URL Cloudsafe
https://support.mozilla.orghttps://truecolors.firefox.com_migrateXULStoreForDocumentbookmarksToolbar0%Avira URL Cloudsafe
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx0%Avira URL Cloudsafe
http://exslt.org/strings0%Avira URL Cloudsafe
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r0%Avira URL Cloudsafe
https://monitor.firefox.com/user/breach-stats?includeResolved=true0%Avira URL Cloudsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report0%Avira URL Cloudsafe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-0%Avira URL Cloudsafe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi0%Avira URL Cloudsafe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=0%Avira URL Cloudsafe
http://www.inbox.lv/rfc2368/?value=%su0%Avira URL Cloudsafe
https://monitor.firefox.com/user/dashboard0%Avira URL Cloudsafe
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID0%Avira URL Cloudsafe
https://monitor.firefox.com/about0%Avira URL Cloudsafe
http://mozilla.org/MPL/2.0/.0%Avira URL Cloudsafe
https://www.openh264.org/0%Avira URL Cloudsafe
https://coverage.mozilla.org0%Avira URL Cloudsafe
http://crl.thawte.com/ThawteTimestampingCA.crl00%Avira URL Cloudsafe
http://x1.c.lencr.org/00%Avira URL Cloudsafe
http://x1.i.lencr.org/00%Avira URL Cloudsafe
https://blocked.cdn.mozilla.net/0%Avira URL Cloudsafe
https://profiler.firefox.com0%Avira URL Cloudsafe
http://developer.mozilla.org/en/docs/DOM:element.addEventListener0%Avira URL Cloudsafe
https://outlook.live.com/default.aspx?rru=compose&to=%s0%Avira URL Cloudsafe
https://poczta.interia.pl/mh/?mailto=%sbrowser.download.viewableInternally.extension/bing0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
example.org
93.184.215.14
truefalseunknown
chrome.cloudflare-dns.com
162.159.61.3
truefalseunknown
prod.classify-client.prod.webservices.mozgcp.net
35.190.72.216
truefalseunknown
prod.balrog.prod.cloudops.mozgcp.net
35.244.181.201
truefalseunknown
prod.detectportal.prod.cloudops.mozgcp.net
34.107.221.82
truefalseunknown
services.addons.mozilla.org
52.222.236.48
truefalseunknown
ipv4only.arpa
192.0.0.170
truefalseunknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net
94.245.104.56
truefalseunknown
prod.remote-settings.prod.webservices.mozgcp.net
34.149.100.209
truefalseunknown
googlehosted.l.googleusercontent.com
142.250.184.225
truefalseunknown
telemetry-incoming.r53-2.services.mozilla.com
34.120.208.123
truefalseunknown
detectportal.firefox.com
unknown
unknownfalseunknown
clients2.googleusercontent.com
unknown
unknownfalseunknown
bzib.nelreports.net
unknown
unknownfalseunknown
firefox.settings.services.mozilla.com
unknown
unknownfalseunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://www.google.com/favicon.icofalse
  • Avira URL Cloud: safe
unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crxfalse
  • Avira URL Cloud: safe
unknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://duckduckgo.com/chrome_newtabWeb Data.8.drfalse
  • Avira URL Cloud: safe
unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://duckduckgo.com/ac/?q=Web Data.8.drfalse
  • Avira URL Cloud: safe
unknown
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lfirefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://detectportal.firefox.com/firefox.exe, 00000006.00000003.2355975429.000002241B33C000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.mozilla.com0firefox.exe, 00000006.00000003.2392118513.000002241D89A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drfalse
  • Avira URL Cloud: safe
unknown
https://smartblock.firefox.etp/facebook.svgwebcompat-reporterfirefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drfalse
  • URL Reputation: safe
unknown
https://www.google.com/policies/privacy/findUpdates()firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsfirefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://merino.services.mozilla.com/api/v1/suggestfirefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF99672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B88E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://csp.withgoogle.com/csp/report-to/apps-themesReporting and NEL.9.drfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protectfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://spocs.getpocket.com/spocsfirefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://docs.google.com/manifest.json.8.drfalse
  • Avira URL Cloud: safe
unknown
https://screenshots.firefox.comfirefox.exe, 00000006.00000003.2183277788.00000224192C2000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://completion.amazon.com/search/complete?q=firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-reportfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://ads.stickyadstv.com/firefox-etpfirefox.exe, 00000006.00000003.2228561697.000002241AEFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BF93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BFD9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2182440447.000002241AEF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tabfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/breach-details/firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://screenshots.firefox.com/shims/rambler-authenticator.jsfirefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEMfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://xhr.spec.whatwg.org/#sync-warningfirefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.amazon.com/exec/obidos/external-search/firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417743000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://profiler.firefox.com/firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.msn.comfirefox.exe, 00000006.00000003.2841772925.00001362F5203000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/mozilla-services/screenshotsfirefox.exe, 00000006.00000002.3275018478.000002241A870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000003.2061278974.000002241B16B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2058342916.000002241AF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060619392.000002241B136000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2061009309.000002241B150000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2060245272.000002241B11C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/addon/firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180usefirefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tracking-protection-issues.herokuapp.com/newfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://exslt.org/setsfirefox.exe, 00000006.00000003.2231616916.0000022416A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416A8E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-reportfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://ac.duckduckgo.com/ac/https://www.google.com/searchLOAD_ANONYMOUS_ALLOW_CLIENT_CERT__instrumefirefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingfirefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://accounts.youtube.com/000003.log2.8.drfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-reportfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://api.accounts.firefox.com/v1firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://exslt.org/commonfirefox.exe, 00000006.00000003.2231616916.0000022416A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416A8E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-2.corp.google.com/manifest.json.8.drfalse
  • Avira URL Cloud: safe
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://fpn.firefox.comfirefox.exe, 00000006.00000003.2230621325.00000224187D9000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.widevine.com/firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protectionsfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=Web Data.8.drfalse
  • Avira URL Cloud: safe
unknown
http://exslt.org/dates-and-timesfirefox.exe, 00000006.00000002.3264109996.0000022416A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416A81000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://ocsp.rootca1.amazontrust.com0:firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%sfirefox.exe, 00000006.00000002.3266205712.000002241707D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-daily-1.corp.google.com/manifest.json.8.drfalse
  • Avira URL Cloud: safe
unknown
https://www.youtube.com/firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3274203132.00000224192EF000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-5.corp.google.com/manifest.json.8.drfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shieldfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://bzib.nelreports.net/api/report?cat=bingbusinessReporting and NEL.9.drfalse
  • URL Reputation: safe
unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://127.0.0.1:firefox.exe, 00000006.00000003.2452940301.000002241AE59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2356165756.000002241AE59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183063589.000002241AE59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3260906891.000002240A36D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://bugzilla.mofirefox.exe, 00000006.00000003.2183201274.000002241AE47000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://mitmdetection.services.mozilla.com/firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://amazon.comfirefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://static.adsafeprotected.com/firefox-etp-jsfirefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2179783061.000002241BFFC000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&reffirefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drfalse
  • URL Reputation: safe
unknown
https://chromewebstore.google.com/manifest.json0.8.drfalse
  • Avira URL Cloud: safe
unknown
https://drive-preprod.corp.google.com/manifest.json.8.drfalse
  • Avira URL Cloud: safe
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477firefox.exe, 00000006.00000003.2885887766.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270632981.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2884909206.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3264109996.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231045968.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183201274.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2184029327.000002241871C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454765700.0000022418707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711345153.000002241AE3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2231616916.0000022416AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255994511.000001EF996E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3254965453.0000027D1B8F8000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.6.drfalse
  • Avira URL Cloud: safe
unknown
https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/ExtHandlerService.sys.mjsextension/binfirefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://chrome.google.com/webstore/manifest.json0.8.drfalse
  • Avira URL Cloud: safe
unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapturefirefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://spocs.getpocket.com/firefox.exe, 00000006.00000003.2357307954.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885740513.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454670900.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270668894.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230961304.000002241877D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2183762670.000002241877D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%firefox.exe, 00000006.00000003.2357641289.000002241CC33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-ffirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.orghttps://truecolors.firefox.com_migrateXULStoreForDocumentbookmarksToolbarfirefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://exslt.org/stringsfirefox.exe, 00000006.00000002.3260906891.000002240A303000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_rfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=truefirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-reportfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-firefox.exe, 00000006.00000003.2453047376.000002241AE17000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYiprefs-1.js.6.drfalse
  • Avira URL Cloud: safe
unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.inbox.lv/rfc2368/?value=%sufirefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2357239629.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2454492925.00000224187BF000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/dashboardfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_IDfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.tsn.cafirefox.exe, 00000006.00000003.2841772925.00001362F5203000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/aboutfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://mozilla.org/MPL/2.0/.firefox.exe, 00000006.00000003.2119352142.000002241D3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2106332384.000002241D4F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2452157787.000002241BA26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2118257131.000002241D4F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2830798526.000002241B43C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2175324467.000002241E508000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2451908889.000002241BC1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2118257131.000002241D4A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2393460083.000002241D3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2083959242.000002241A9F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2106332384.000002241D4A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2710527772.000002241D3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2226624543.000002241D36B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2175135103.000002241E533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2162411167.000002241A9F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2178299452.000002241D4F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2390918180.000002241A9FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2227730122.000002241BC1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2175061597.000002241E557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2182387324.000002241AF0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2829218127.000002241B137000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.openh264.org/firefox.exe, 00000006.00000002.3265207142.0000022416BD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.00000224177B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.0000022417703000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://coverage.mozilla.orgfirefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0firefox.exe, 00000006.00000003.2392118513.000002241D89A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2395667932.000002241C000000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.6.drfalse
  • Avira URL Cloud: safe
unknown
https://csp.withgoogle.com/csp/report-to/AccountsSignInUiReporting and NEL.9.drfalse
  • URL Reputation: safe
unknown
http://x1.c.lencr.org/0firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://x1.i.lencr.org/0firefox.exe, 00000006.00000003.2122945896.000002241BE2D000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://blocked.cdn.mozilla.net/firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://developer.mozilla.org/en/docs/DOM:element.addEventListenerfirefox.exe, 00000006.00000003.2228358059.000002241B0C5000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://profiler.firefox.comfirefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3263099772.00000224168B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.3255091148.000001EF99270000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3258106467.0000027D1BDA0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://outlook.live.com/default.aspx?rru=compose&to=%sfirefox.exe, 00000006.00000003.2183525831.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2167851278.0000022418877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2230701221.00000224187D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2832300800.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3270955809.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2711868948.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2885480950.00000224187BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3271651490.000002241887F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://poczta.interia.pl/mh/?mailto=%sbrowser.download.viewableInternally.extension/bingfirefox.exe, 00000006.00000002.3267999239.000002241777E000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
13.107.246.40
unknownUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
152.195.19.97
unknownUnited States
15133EDGECASTUSfalse
172.253.63.84
unknownUnited States
15169GOOGLEUSfalse
142.251.40.227
unknownUnited States
15169GOOGLEUSfalse
142.250.176.206
unknownUnited States
15169GOOGLEUSfalse
23.219.161.132
unknownUnited States
20940AKAMAI-ASN1EUfalse
162.159.61.3
chrome.cloudflare-dns.comUnited States
13335CLOUDFLARENETUSfalse
142.251.41.14
unknownUnited States
15169GOOGLEUSfalse
23.43.85.27
unknownUnited States
3257GTT-BACKBONEGTTDEfalse
142.251.32.100
unknownUnited States
15169GOOGLEUSfalse
142.250.184.225
googlehosted.l.googleusercontent.comUnited States
15169GOOGLEUSfalse
52.222.236.48
services.addons.mozilla.orgUnited States
16509AMAZON-02USfalse
34.120.208.123
telemetry-incoming.r53-2.services.mozilla.comUnited States
15169GOOGLEUSfalse
94.245.104.56
ssl.bingadsedgeextension-prod-europe.azurewebsites.netUnited Kingdom
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
34.149.100.209
prod.remote-settings.prod.webservices.mozgcp.netUnited States
2686ATGS-MMD-ASUSfalse
34.107.221.82
prod.detectportal.prod.cloudops.mozgcp.netUnited States
15169GOOGLEUSfalse
35.244.181.201
prod.balrog.prod.cloudops.mozgcp.netUnited States
15169GOOGLEUSfalse
142.251.167.84
unknownUnited States
15169GOOGLEUSfalse
239.255.255.250
unknownReserved
unknownunknownfalse
35.190.72.216
prod.classify-client.prod.webservices.mozgcp.netUnited States
15169GOOGLEUSfalse

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1505363
Start date and time:2024-09-06 05:35:07 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 6m 28s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:23
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:file.exe
Detection:MAL
Classification:mal64.evad.winEXE@71/269@30/22
EGA Information:
  • Successful, ratio: 66.7%
HCA Information:
  • Successful, ratio: 96%
  • Number of executed functions: 36
  • Number of non-executed functions: 315
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 13.107.42.16, 64.233.167.84, 13.107.21.239, 204.79.197.239, 172.217.16.206, 13.107.6.158, 2.19.126.145, 2.19.126.152, 172.217.16.131, 142.250.186.163, 2.23.209.187, 2.23.209.140, 2.23.209.130, 2.23.209.149, 2.23.209.133, 2.23.209.182, 20.74.47.205, 93.184.221.240, 192.229.221.95, 2.22.61.59, 2.22.61.56, 142.250.184.238, 172.217.18.110, 142.250.72.99, 142.251.40.131
  • Excluded domains from analysis (whitelisted): ciscobinary.openh264.org, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, incoming.telemetry.mozilla.org, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, arc.msn.com, iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, redirector.gvt1.com, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, api.edgeoffer.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, detectportal.prod.mozaws.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.ne
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtWriteVirtualMemory calls found.
  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
13.107.246.40Payment Transfer Receipt.shtmlGet hashmaliciousHTMLPhisherBrowse
  • www.aib.gov.uk/
NEW ORDER.xlsGet hashmaliciousUnknownBrowse
  • 2s.gg/3zs
PO_OCF 408.xlsGet hashmaliciousUnknownBrowse
  • 2s.gg/42Q
06836722_218 Aluplast.docx.docGet hashmaliciousUnknownBrowse
  • 2s.gg/3zk
Quotation.xlsGet hashmaliciousUnknownBrowse
  • 2s.gg/3zM
152.195.19.97http://ustteam.com/Get hashmaliciousUnknownBrowse
  • www.ust.com/
23.219.161.132file.exeGet hashmaliciousUnknownBrowse
    file.exeGet hashmaliciousUnknownBrowse
      file.exeGet hashmaliciousUnknownBrowse
        file.exeGet hashmaliciousUnknownBrowse
          file.exeGet hashmaliciousUnknownBrowse
            file.exeGet hashmaliciousUnknownBrowse
              file.exeGet hashmaliciousUnknownBrowse
                file.exeGet hashmaliciousUnknownBrowse
                  tXwWf89bXc.exeGet hashmaliciousUnknownBrowse
                    UPrvrJFnEx.exeGet hashmaliciousUnknownBrowse

                      Domains

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      chrome.cloudflare-dns.comfile.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      https://ws.onehub.com/folders/xxma24lqGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      example.orgfile.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      ipv4only.arpafile.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.171
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.171
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.171
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.170
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.170
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.170
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.171
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.170
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.171
                      file.exeGet hashmaliciousUnknownBrowse
                      • 192.0.0.170
                      services.addons.mozilla.orgfile.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.23
                      file.exeGet hashmaliciousUnknownBrowse
                      • 3.165.190.17
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.80
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.48
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.48
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.23
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      file.exeGet hashmaliciousUnknownBrowse
                      • 108.156.60.43

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      CLOUDFLARENETUSSecuriteInfo.com.Trojan-Dropper.Win32.Dapato.samj.28710.4304.exeGet hashmaliciousUnknownBrowse
                      • 104.21.71.28
                      https://u1404228.ct.sendgrid.net/ls/click?upn=u001.53NsXfgUBOeYzK87Mt8UmmFmJrZ7XUeaM2H1JJzIOlLD8XdRMGUjLjiETSkkNSOO1aPcOhsB-2B6p58337PPTvLBJHf93ZwdhKuc0pYJ3CCFhPzGYkRFXax0jGvIeRFmcP5G0BUyJ6YhdCuxj2rmKfEA3sfYg2UNxl72w1Me3oPfdrF6jbhGk315PA9TABMIUQaw-2BWiKWUThNlxL-2FiIJdoH5tiTQT-2Bm8o6f2DtPJqJqYyOmKsC6Z8r8BDMH-2BRyR0DPAbc1o4jsJAeLDJ31LwWjsFQYr3zFK5cIf8Mbd-2BRzOeXFDSMm6es3Y0fepvpPG5r7pfagssMFSYnyu8MHsVv5hRcIKJqjAZyLx1ckeV-2FaCznPfw8naJb82iSt3TNueNL1vH7DevWmKVRPxk4wZ5wzTJXKbWW9anlXuh-2BQXFzp8R8-2BdEEizEjCv3UcDuHMQ1pDH865wy4DUZnYMpZjJQJPawcQswhgRnWgvPzhIRyQE-2Bc-3DkIeO_CR4Iv1KReyG-2BUTiHEM2iSrmxUTGCd7nll-2F8pyW4fRHUIiL68JldL5hjEvlqIxpWk9hPYxNH8eo9VRHfVERALBwpMyAhjDc4FUwScFs2ucRUabaJ73tdO-2FPebairfMf4xwZ2dpDlmkqO5pmgc1gE0gGghSpi3dDGJNhz4YymAGUOPzRzAYltzk0Ba7IAVZeXH7Jn8rume2KIoU57-2Fl62ae-2FaTXSu1TIVQ6Migf-2F6NGXqO6vztNaikiQe23mzDzfi19JJ-2FVN5j6ZPVhD34lLHzKpdiifzixAZur7VZCR5Hc24MfYQGTYVbJWBIhMdpT2lgG-2Bg-2FTIWWIZlY-2Fzm-2BK3i-2F0Q-3D-3DGet hashmaliciousUnknownBrowse
                      • 172.64.151.101
                      All-in-one Calculation Tool.xlsmGet hashmaliciousUnknownBrowse
                      • 1.1.1.1
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousLummaC, VidarBrowse
                      • 104.21.10.172
                      http://www.internal-checker.com/Get hashmaliciousUnknownBrowse
                      • 104.18.72.113
                      https://bafkreih4ip5zjsxef3jbe32pyegreos33fovmx4546n5bglt5plmopvjiq.ipfs.dweb.link/Get hashmaliciousHTMLPhisherBrowse
                      • 104.17.25.14
                      AKAMAI-ASN1EUfile.exeGet hashmaliciousUnknownBrowse
                      • 23.44.201.16
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.44.201.27
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.44.133.38
                      file.exeGet hashmaliciousUnknownBrowse
                      • 104.126.116.43
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.219.82.8
                      file.exeGet hashmaliciousUnknownBrowse
                      • 104.70.121.219
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.59.250.35
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.219.82.26
                      Setup.exeGet hashmaliciousLummaC StealerBrowse
                      • 23.197.127.21
                      https://jtielectrical-my.sharepoint.com/:f:/g/personal/wwise_jtielectric_com/EiRUStVFyApDuTy9pUHQbzMB7Ixh_nngG6WTsOeTzF4k1w?e=MsJpM6Get hashmaliciousUnknownBrowse
                      • 2.16.238.149
                      EDGECASTUSfile.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      https://xy2.eu/3k2fIGet hashmaliciousUnknownBrowse
                      • 192.229.221.25
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      Status Update NGKUV.htmlGet hashmaliciousHTMLPhisherBrowse
                      • 152.199.21.175
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      MICROSOFT-CORP-MSN-AS-BLOCKUSAll-in-one Calculation Tool.xlsmGet hashmaliciousUnknownBrowse
                      • 52.111.243.31
                      All-in-one Calculation Tool.xlsmGet hashmaliciousUnknownBrowse
                      • 13.107.246.57
                      file.exeGet hashmaliciousUnknownBrowse
                      • 13.107.246.57
                      file.exeGet hashmaliciousUnknownBrowse
                      • 94.245.104.56
                      file.exeGet hashmaliciousUnknownBrowse
                      • 20.75.60.91
                      file.exeGet hashmaliciousUnknownBrowse
                      • 13.107.246.51
                      http://geminiak.weebly.com/Get hashmaliciousUnknownBrowse
                      • 51.104.148.203
                      http://mettamask-org-exoi.webflow.io/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      http://support-metamlk-exten.webflow.io/Get hashmaliciousUnknownBrowse
                      • 150.171.28.10
                      http://help-s-sso-metmeask.webflow.io/Get hashmaliciousUnknownBrowse
                      • 150.171.28.10

                      JA3 Fingerprints

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      28a2c9bd18a11de089ef85a160da29e4https://u1404228.ct.sendgrid.net/ls/click?upn=u001.53NsXfgUBOeYzK87Mt8UmmFmJrZ7XUeaM2H1JJzIOlLD8XdRMGUjLjiETSkkNSOO1aPcOhsB-2B6p58337PPTvLBJHf93ZwdhKuc0pYJ3CCFhPzGYkRFXax0jGvIeRFmcP5G0BUyJ6YhdCuxj2rmKfEA3sfYg2UNxl72w1Me3oPfdrF6jbhGk315PA9TABMIUQaw-2BWiKWUThNlxL-2FiIJdoH5tiTQT-2Bm8o6f2DtPJqJqYyOmKsC6Z8r8BDMH-2BRyR0DPAbc1o4jsJAeLDJ31LwWjsFQYr3zFK5cIf8Mbd-2BRzOeXFDSMm6es3Y0fepvpPG5r7pfagssMFSYnyu8MHsVv5hRcIKJqjAZyLx1ckeV-2FaCznPfw8naJb82iSt3TNueNL1vH7DevWmKVRPxk4wZ5wzTJXKbWW9anlXuh-2BQXFzp8R8-2BdEEizEjCv3UcDuHMQ1pDH865wy4DUZnYMpZjJQJPawcQswhgRnWgvPzhIRyQE-2Bc-3DkIeO_CR4Iv1KReyG-2BUTiHEM2iSrmxUTGCd7nll-2F8pyW4fRHUIiL68JldL5hjEvlqIxpWk9hPYxNH8eo9VRHfVERALBwpMyAhjDc4FUwScFs2ucRUabaJ73tdO-2FPebairfMf4xwZ2dpDlmkqO5pmgc1gE0gGghSpi3dDGJNhz4YymAGUOPzRzAYltzk0Ba7IAVZeXH7Jn8rume2KIoU57-2Fl62ae-2FaTXSu1TIVQ6Migf-2F6NGXqO6vztNaikiQe23mzDzfi19JJ-2FVN5j6ZPVhD34lLHzKpdiifzixAZur7VZCR5Hc24MfYQGTYVbJWBIhMdpT2lgG-2Bg-2FTIWWIZlY-2Fzm-2BK3i-2F0Q-3D-3DGet hashmaliciousUnknownBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      http://31.41.244.9/nokia/lamp.exeGet hashmaliciousStealcBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      All-in-one Calculation Tool.xlsmGet hashmaliciousUnknownBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      file.exeGet hashmaliciousUnknownBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      file.exeGet hashmaliciousUnknownBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      file.exeGet hashmaliciousUnknownBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      file.exeGet hashmaliciousUnknownBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      http://dappdefi-layer.com/Get hashmaliciousUnknownBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      http://www.internal-checker.com/Get hashmaliciousUnknownBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      http://hoangboy23.github.io/Get hashmaliciousHTMLPhisherBrowse
                      • 13.85.23.86
                      • 184.28.90.27
                      fb0aa01abe9d8e4037eb3473ca6e2dcafile.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123
                      file.exeGet hashmaliciousUnknownBrowse
                      • 35.244.181.201
                      • 34.149.100.209
                      • 52.222.236.48
                      • 34.120.208.123

                      Dropped Files

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpfile.exeGet hashmaliciousUnknownBrowse
                        file.exeGet hashmaliciousUnknownBrowse
                          file.exeGet hashmaliciousUnknownBrowse
                            file.exeGet hashmaliciousUnknownBrowse
                              file.exeGet hashmaliciousUnknownBrowse
                                file.exeGet hashmaliciousUnknownBrowse
                                  file.exeGet hashmaliciousUnknownBrowse
                                    file.exeGet hashmaliciousUnknownBrowse
                                      file.exeGet hashmaliciousUnknownBrowse
                                        file.exeGet hashmaliciousUnknownBrowse
                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)file.exeGet hashmaliciousUnknownBrowse
                                            file.exeGet hashmaliciousUnknownBrowse
                                              file.exeGet hashmaliciousUnknownBrowse
                                                file.exeGet hashmaliciousUnknownBrowse
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                    file.exeGet hashmaliciousUnknownBrowse
                                                      file.exeGet hashmaliciousUnknownBrowse
                                                        file.exeGet hashmaliciousUnknownBrowse
                                                          file.exeGet hashmaliciousUnknownBrowse
                                                            file.exeGet hashmaliciousUnknownBrowse

                                                              Created / dropped Files

                                                              C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_db20cd9d-d93f-45ab-8fc3-0ae865679226.json (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6439
                                                              Entropy (8bit):5.140617995541502
                                                              Encrypted:false
                                                              SSDEEP:192:PKMX8u8I8bcbhbVbTbfbRbObtbyEznpnSrDtTZdB:PP0cNhnzFSJ7nSrDhZdB
                                                              MD5:8E897DD5D4B2A0857331D524191F71F6
                                                              SHA1:9492DFE3AA2EC613A4D204CA26934887066ECF4D
                                                              SHA-256:F97AE4F515B5233BC74998C308299A22CC0940A29F49DA06B326F5A2E92532EA
                                                              SHA-512:36A6B7D976FF3C845C1B1207FDFC741D909EFCB699FA8C8BC9F16230663D37E0EB40757231163D95625407BC974063B48D3451844DB258F683328B95E91A98C5
                                                              Malicious:false
                                                              Preview:{"type":"uninstall","id":"db20cd9d-d93f-45ab-8fc3-0ae865679226","creationDate":"2024-09-06T05:36:39.253Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                              C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_db20cd9d-d93f-45ab-8fc3-0ae865679226.json.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6439
                                                              Entropy (8bit):5.140617995541502
                                                              Encrypted:false
                                                              SSDEEP:192:PKMX8u8I8bcbhbVbTbfbRbObtbyEznpnSrDtTZdB:PP0cNhnzFSJ7nSrDhZdB
                                                              MD5:8E897DD5D4B2A0857331D524191F71F6
                                                              SHA1:9492DFE3AA2EC613A4D204CA26934887066ECF4D
                                                              SHA-256:F97AE4F515B5233BC74998C308299A22CC0940A29F49DA06B326F5A2E92532EA
                                                              SHA-512:36A6B7D976FF3C845C1B1207FDFC741D909EFCB699FA8C8BC9F16230663D37E0EB40757231163D95625407BC974063B48D3451844DB258F683328B95E91A98C5
                                                              Malicious:false
                                                              Preview:{"type":"uninstall","id":"db20cd9d-d93f-45ab-8fc3-0ae865679226","creationDate":"2024-09-06T05:36:39.253Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\32e7b48f-c70e-401f-b9c7-bf6c3e15ab14.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):45979
                                                              Entropy (8bit):6.088466522623901
                                                              Encrypted:false
                                                              SSDEEP:768:mMGQ7FCYXGIgtDAWtJ4U9E0MQhDO6vP6OHFT9tVu/IFFXVVQavCAofGoup1Xl3jz:mMGQ5XMBn9E16n99/pyavRofhu3VlXrF
                                                              MD5:BFFD26DAB5B88DAC8656F567750FAC31
                                                              SHA1:FE9644B6E626013275D9BD228730C97D75B58A85
                                                              SHA-256:699C5B17A9ECDE4B97AEEE49305A1251E2103405D5AA7E3F7BB006B3F7E68D35
                                                              SHA-512:58B489266083BCDD6723F83ECE36EC945562C564C9268C67189981D86D310ED61E721EF41A226CFDF4C797E84CBD03DB2D2408C5B266246274FA70EDC60B7C1B
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\59c4c175-baa6-421b-a211-47c2049d5e93.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):45979
                                                              Entropy (8bit):6.088468402298342
                                                              Encrypted:false
                                                              SSDEEP:768:mMGQ7FCYXGIgtDAWtJ4UoE0MQhDO6vP6OHFT9tVu/IFFXVVQavCAofGoup1Xl3jz:mMGQ5XMBnoE16n99/pyavRofhu3VlXrF
                                                              MD5:1E5BCD760DB1EE922B50D92E1E8876F0
                                                              SHA1:B47F550BB99F6E19D59F8512B34D603555E3AA7F
                                                              SHA-256:878CF734E45314EA2BE485C6AB07A4BC331F61A25B818BB361003FC8838BB70A
                                                              SHA-512:523F7470DC00A30B05FA402949F6E48C67C31DC0F6E90790EB04B85E5EEC658B1D7DCE681C270DAF91C58F8F84D5DA31B14A5DDD42888913D25904FE2F01D1B1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5d6e763f-9f8f-4c36-ad79-7bc82122cc43.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44600
                                                              Entropy (8bit):6.096937735825604
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBxwujhDO6vP6OHFT9hh//OQJDK7TZcGoup1Xl3jVu:z/Ps+wsI7ynEQ6n99qchu3VlXr4CRo1
                                                              MD5:C3901789EB1A640C2421753E11331C3F
                                                              SHA1:452C877FF330A39E441BB9272003688964931B56
                                                              SHA-256:D9B865CFBDF8D0F2BFC1F8EF10AD49BF1AFD1E2207EC4D07BC3A5651B510A8D8
                                                              SHA-512:19C77B2FE8368D0144C0DC5FD685BD0034D8AF521E1D22EE6F6AA145EF0CBD2159BBF30BEAE8B32F8C0D5623D102F25CD389BC34CE764814073632A457A7F61D
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6e08a5ab-f8ce-4701-8cf6-86f1a16668fd.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:modified
                                                              Size (bytes):44600
                                                              Entropy (8bit):6.096937735825604
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBxwujhDO6vP6OHFT9hh//OQJDK7TZcGoup1Xl3jVu:z/Ps+wsI7ynEQ6n99qchu3VlXr4CRo1
                                                              MD5:C3901789EB1A640C2421753E11331C3F
                                                              SHA1:452C877FF330A39E441BB9272003688964931B56
                                                              SHA-256:D9B865CFBDF8D0F2BFC1F8EF10AD49BF1AFD1E2207EC4D07BC3A5651B510A8D8
                                                              SHA-512:19C77B2FE8368D0144C0DC5FD685BD0034D8AF521E1D22EE6F6AA145EF0CBD2159BBF30BEAE8B32F8C0D5623D102F25CD389BC34CE764814073632A457A7F61D
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\89a2520e-23ef-46f9-af63-15eeb160b000.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):45902
                                                              Entropy (8bit):6.088539694910696
                                                              Encrypted:false
                                                              SSDEEP:768:mMGQ7FCYXGIgtDAWtJ4n9E0MQhDO6vP6OHFT9ZVu/IFFXVVQavCAofGoup1Xl3jz:mMGQ5XMBG9E16n99LpyavRofhu3VlXrF
                                                              MD5:71FF0AB4E6CE142F3C7D24FD338579ED
                                                              SHA1:361C8A36945A9E9B9C94FE48A401D0B827B62AC1
                                                              SHA-256:8F258E59CAB7F69174BCEE8F792AC874B2DE129E6FA8608AFEEE2751D747BE3A
                                                              SHA-512:C2D4CF224DBEC756234396C2A6B52217077B92F59A79DEFD15F4D84F84B0C47D10B1A22719E6D2EC3D59C6CD3B0F7A1AA4BD6D177341EB505A5D6CAAFDD6F7CD
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):107893
                                                              Entropy (8bit):4.640149995732079
                                                              Encrypted:false
                                                              SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
                                                              MD5:AD9FA3B6C5E14C97CFD9D9A6994CC84A
                                                              SHA1:EF063B4A4988723E0794662EC9D9831DB6566E83
                                                              SHA-256:DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
                                                              SHA-512:81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
                                                              Malicious:false
                                                              Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ef71d87f-a0ad-40ba-8900-80fb7cddd90c.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):107893
                                                              Entropy (8bit):4.640149995732079
                                                              Encrypted:false
                                                              SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
                                                              MD5:AD9FA3B6C5E14C97CFD9D9A6994CC84A
                                                              SHA1:EF063B4A4988723E0794662EC9D9831DB6566E83
                                                              SHA-256:DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
                                                              SHA-512:81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
                                                              Malicious:false
                                                              Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3::
                                                              MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                              SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                              SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                              SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3::
                                                              MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                              SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                              SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                              SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DA789A-1CA8.pma

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.47160493350391236
                                                              Encrypted:false
                                                              SSDEEP:6144:HvyjRREbBFnMaHd4wH4QT61oclzDaHDA3:XFnP1Hwu
                                                              MD5:F94FB91FDEE98162A3EA2899A317F653
                                                              SHA1:48F695117A5FC633149889FED52B9F72EFA88C53
                                                              SHA-256:C47BFDB1362D74BD261C6560D1C2A29DA3B9CA83AEAF4E2D68BE0F271F7C84D8
                                                              SHA-512:9B059D8717262C616ECB2AC3A810177F777F3780F68B2C8BE353AF7F5453001EEF9EEE2CBB17084AB6FBBF80627D10AA095592C47B278727FE7B7B99BB03B28A
                                                              Malicious:false
                                                              Preview:...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".iaehvc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K..>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........6...... .2...............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):280
                                                              Entropy (8bit):4.132041621771752
                                                              Encrypted:false
                                                              SSDEEP:3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
                                                              MD5:845CFA59D6B52BD2E8C24AC83A335C66
                                                              SHA1:6882BB1CE71EB14CEF73413EFC591ACF84C63C75
                                                              SHA-256:29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
                                                              SHA-512:8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
                                                              Malicious:false
                                                              Preview:sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7894fc11-3e8e-415c-a9b0-a48cf38d836c.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):10342
                                                              Entropy (8bit):5.214299336079001
                                                              Encrypted:false
                                                              SSDEEP:192:st3kdzss+tsZihPykAD+3K8obV+FIjQA66WcaFIMYAPnYJ:st34ss+tfhP6DnbGEQx6WcaTYJ
                                                              MD5:8929E1B5E1D5EC130FFCA1161C462D1E
                                                              SHA1:9152EA737568C2E0F72357B9BC50112FC1612F23
                                                              SHA-256:EAEFD6E69CC887ACCEB1163E1FBA5D1324BBEEE41DB8DAB0938D4478792D538F
                                                              SHA-512:44C0124D9B912C2A88737CDDB819F9F54B7D005839AE70970C950FB3994BB6BF31328F8D8861253B83C6E83AC07AF6063D79469320FA75EFF270063EFF61CA69
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370067355800565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\83f37b23-a97d-4129-80f1-70ece419a0cd.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:L:L
                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                              Malicious:false
                                                              Preview:.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):33
                                                              Entropy (8bit):3.5394429593752084
                                                              Encrypted:false
                                                              SSDEEP:3:iWstvhYNrkUn:iptAd
                                                              MD5:F27314DD366903BBC6141EAE524B0FDE
                                                              SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                              SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                              SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                              Malicious:false
                                                              Preview:...m.................DB_VERSION.1

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):309
                                                              Entropy (8bit):5.219702709093309
                                                              Encrypted:false
                                                              SSDEEP:6:PSUq1923oH+Tcwtp3hBtB2KLllSe2X7YVq2P923oH+Tcwtp3hBWsIFUv:PSUfYebp3dFLnSefVv4Yebp3eFUv
                                                              MD5:D8FF3EAE6E279FC02F53D6E3DF7FA9D6
                                                              SHA1:A7EFE4D28654EC73979CC946F6EA67A0F5853E81
                                                              SHA-256:A45DEDFBE775162AFF84B8DD923D3D0019F7903D6AC9B694C7F216DBE0C3DE75
                                                              SHA-512:370167550BEDF682FB240569A9966272CD65960FBABC97E89238A8ABFDA7F1C04C28CBF3DF42F57DCB15CB9B7C09AA5655F90D1573A30E97E0D5580BCC4AE665
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:00.266 2040 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/09/05-23:36:00.277 2040 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:modified
                                                              Size (bytes):480979
                                                              Entropy (8bit):5.3948576487597055
                                                              Encrypted:false
                                                              SSDEEP:3072:v+477TZyhJOGiMlbOFbXG/KFd2X13p8S15tndAYDI11csxZ:v+4zZoOG1eLG/KKp8cdAYDI11csz
                                                              MD5:F9489D38BE10F124FB54041594B796DC
                                                              SHA1:540706197005241586B5C98F9DB96EA3CD001371
                                                              SHA-256:94CE7981DAFF5BF9DF3E7E0C9595DD679CC88367A2E2DDE1FF57C4E6E02FA50F
                                                              SHA-512:C7AB61BEA227E6AA177318A8CFD3A7B9B4730772BD10FCA2D25E1963AA6254C7F94D6D5EA91A2C422714B75523EEE63A18F99B243A950A82FFF98CA209FD945A
                                                              Malicious:false
                                                              Preview:...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13340900604462938.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):336
                                                              Entropy (8bit):5.1353490668995105
                                                              Encrypted:false
                                                              SSDEEP:6:PS2Hac+q2P923oH+Tcwt9Eh1tIFUt82S2FmZmw+2S2KF+VkwO923oH+Tcwt9Eh1H:PS2Hac+v4Yeb9Eh16FUt82S2Fm/+2S2M
                                                              MD5:AD92910980E854464C39D3BBA43D19E5
                                                              SHA1:E692ACCEDB9EF6CA03DCCA1C1D7CADA2864BA630
                                                              SHA-256:24AD69E2F401B358EAF476D330F0B2D67628587CF4F04EFCEA0209459E283F5E
                                                              SHA-512:3F90FA039E91BACB8B4725EF90D687CCCDBAE74155648EF70FA6D03BA80CAB8E0C413618CA39900F6501690D36C5DB5E7801BE557DA91972B034315D9E19068D
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:01.489 20dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/09/05-23:36:01.491 20dc Recovering log #3.2024/09/05-23:36:01.498 20dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):336
                                                              Entropy (8bit):5.1353490668995105
                                                              Encrypted:false
                                                              SSDEEP:6:PS2Hac+q2P923oH+Tcwt9Eh1tIFUt82S2FmZmw+2S2KF+VkwO923oH+Tcwt9Eh1H:PS2Hac+v4Yeb9Eh16FUt82S2Fm/+2S2M
                                                              MD5:AD92910980E854464C39D3BBA43D19E5
                                                              SHA1:E692ACCEDB9EF6CA03DCCA1C1D7CADA2864BA630
                                                              SHA-256:24AD69E2F401B358EAF476D330F0B2D67628587CF4F04EFCEA0209459E283F5E
                                                              SHA-512:3F90FA039E91BACB8B4725EF90D687CCCDBAE74155648EF70FA6D03BA80CAB8E0C413618CA39900F6501690D36C5DB5E7801BE557DA91972B034315D9E19068D
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:01.489 20dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/09/05-23:36:01.491 20dc Recovering log #3.2024/09/05-23:36:01.498 20dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):28672
                                                              Entropy (8bit):0.4645347046726165
                                                              Encrypted:false
                                                              SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfB:TouQq3qh7z3bY2LNW9WMcUvB
                                                              MD5:9B107E22E3AA44A7E0B12E118540F066
                                                              SHA1:FE2730A2DF63666D070C78DE9479D19809348F78
                                                              SHA-256:F5A5F0F1B73BDCB566FFF28CCCBAF39163A89FC9BD2BCE583983A947FD0611FA
                                                              SHA-512:96B4CB08AFF011B0D6B352D4E578B20CB48DFF1F4680B70585F129005B6FEACE1F269A32C148DBA93259D7C94499214232786CA3DA3576EC177B906132C04D7F
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                              Category:dropped
                                                              Size (bytes):10240
                                                              Entropy (8bit):0.8708334089814068
                                                              Encrypted:false
                                                              SSDEEP:12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
                                                              MD5:92F9F7F28AB4823C874D79EDF2F582DE
                                                              SHA1:2D4F1B04C314C79D76B7FF3F50056ECA517C338B
                                                              SHA-256:6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
                                                              SHA-512:86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):636554
                                                              Entropy (8bit):6.0127694795093625
                                                              Encrypted:false
                                                              SSDEEP:12288:BhjHVMIvgjD8xIXualvzHR7iaQKR+8JbtlmkdBC1esJxrVcQNaiBa:Bhq+kaIXnQs+Qb3mkGbJo5
                                                              MD5:CDE9ABB05D9CF09C0DA933480FEC3B64
                                                              SHA1:D28F62243CA290594B0EB556FE0831AA6FCC6C8A
                                                              SHA-256:036961C14225D6DD3397D4EA5B38D010A7F0EE778CFDBEFE9437F37DDE78E39F
                                                              SHA-512:FFD65D76C5DF99F63EDE9695B15CE7D3AD175FB87AD8C708DDBBF5E3747379CBCA0F30C5146E7EE1A86037DB96A63F36AAAD5606D6D95BF45022E3024BF2F018
                                                              Malicious:false
                                                              Preview:...m.................DB_VERSION.1.!Z2.................BLOOM_FILTER:..&{"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3767945,"primeBases":[5381,5381,5381,5381],"supportedDomains":"+o3+RncW1oGSCAJdFuTFqUW6YaGaAbCC0mXuZLc6TAdWf+a3VWHilOI7HUSutZN7jjBKd4Xi34zSVDgDggvk4iE7SFOUe0to/ca2Z9NKMxb3353s+Xz5MJEyQlwFGH9Q4NPsSG7/Mg0OzIizAAoQKAb68INGxcqMD8b8cjATmbZA8J3gaDgCBh+FwkLSt7ItZOvFiz1UWGdFoGeWLVoid0mXBF1tVxiUsnfZrTOYUq+ybxegQgLR7oDn/09U0naczNrckPPeVov9TOq080La20glc39nrbTQ161ERvbKrN6QBMsgiTOHVfZfSTGNbPb7sPb+5dDTy5Pj4SDC6TCZj8jX3zHAoaELBAojh3rXGAdRcmlzljl/F2zoyuFBIUzr1kW7W1ersVw2uiPbjdETQ6f6PzQr5AIUQSnGkCAK4eY8TDM6HLdxH8VjohD4l8UWF3Y9XOks322TYQmhq7J/I5qw0+ibgaYj2D0vvNSxCuIJMAcBjJAiV3jSfyJZCI7hs3VWZSRjobGr+J4EqQa3vtIovMi1uA9KKefV9pM81NjK5N2TORH5BQe9Np+dJNRjevW/vXAW4n+oqu76r1jaC4FKAy9+Xb5xIFPlpZDNzVhz/6/ct6Hct8kU9B96g6Gv3o9/8jKq///viYVNKvcp+tGhn40YSm6uaOjATydJjaZqudEoej2VEh/hMKMwBMZNV2DvJuxJfXP9Vxyc06+ZH2XLctB6KM125+jdQ7UtY9dujxJcJ6P5ONGgAQohAe9Jqk8wYOnC5u/cDvlnwhGVt8QSnkPqM+ce4mL

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000004.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):142
                                                              Entropy (8bit):5.034720616075599
                                                              Encrypted:false
                                                              SSDEEP:3:GclvX38E28xp4m3rscUSXQTEmUSwiJtlf+nETPxpK2x7LuX4VhvCTG:Gcp38D8xSEsIXGEty+n0PxEWA4VF
                                                              MD5:1604716F232F25E8816005DA0A256B8F
                                                              SHA1:52063F01B6CA00CBF44113A97C3AF06D7000229C
                                                              SHA-256:1E551FB9418FFB9E05692A4C128D8556F900F73CAA29D39953466BC376D89DE3
                                                              SHA-512:F4D0D6C76F49CA1E4205B3D947E4A69BE249FDE20618E61A36D983BCA6E4182966085EEC01A07A84B4C1C816F7F13FB09AE1CA59AA9A0731EBD941170BD5FD1F
                                                              Malicious:false
                                                              Preview:."..9................BLOOM_FILTER_EXPIRY_TIME:.1725680161.985778L.a.G................BLOOM_FILTER_LAST_MODIFIED:.Fri, 06 Sep 2024 01:06:01 GMT

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):636529
                                                              Entropy (8bit):6.012178686683981
                                                              Encrypted:false
                                                              SSDEEP:12288:vhEHVMavgBg8bIXuHlvzHM7iawKRt8AbtA0kdBO1esJxLVcWGaiQX:vh7cNaIXxwstXb+0kKbJ1l
                                                              MD5:D06FF4898FA4B70F70844C78C74E85F1
                                                              SHA1:343AACAE98E528494912A7795CFDA3320598B8B9
                                                              SHA-256:7075C56053C9821ACF183DBB7CF38F0EB58DED5773450E7FC5D015DAF9885A11
                                                              SHA-512:ADD667D77284908B8DE405827BA3BFA0D56A8E19DEC93D4E3B5CB6731001D86AA65899CEC389DDC0D50D40A95DFBFEF10838C3BB3E565330EE72F7E5C43A1AC1
                                                              Malicious:false
                                                              Preview:....&BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3767945,"primeBases":[5381,5381,5381,5381],"supportedDomains":"+o3+RncW1oGSCAJdFuTFqUW6YaGaAbCC0mXuZLc6TAdWf+a3VWHilOI7HUSutZN7jjBKd4Xi34zSVDgDggvk4iE7SFOUe0to/ca2Z9NKMxb3353s+Xz5MJEyQlwFGH9Q4NPsSG7/Mg0OzIizAAoQKAb68INGxcqMD8b8cjATmbZA8J3gaDgCBh+FwkLSt7ItZOvFiz1UWGdFoGeWLVoid0mXBF1tVxiUsnfZrTOYUq+ybxegQgLR7oDn/09U0naczNrckPPeVov9TOq080La20glc39nrbTQ161ERvbKrN6QBMsgiTOHVfZfSTGNbPb7sPb+5dDTy5Pj4SDC6TCZj8jX3zHAoaELBAojh3rXGAdRcmlzljl/F2zoyuFBIUzr1kW7W1ersVw2uiPbjdETQ6f6PzQr5AIUQSnGkCAK4eY8TDM6HLdxH8VjohD4l8UWF3Y9XOks322TYQmhq7J/I5qw0+ibgaYj2D0vvNSxCuIJMAcBjJAiV3jSfyJZCI7hs3VWZSRjobGr+J4EqQa3vtIovMi1uA9KKefV9pM81NjK5N2TORH5BQe9Np+dJNRjevW/vXAW4n+oqu76r1jaC4FKAy9+Xb5xIFPlpZDNzVhz/6/ct6Hct8kU9B96g6Gv3o9/8jKq///viYVNKvcp+tGhn40YSm6uaOjATydJjaZqudEoej2VEh/hMKMwBMZNV2DvJuxJfXP9Vxyc06+ZH2XLctB6KM125+jdQ7UtY9dujxJcJ6P5ONGgAQohAe9Jqk8wYOnC5u/cDvlnwhGVt8QSnkPqM+ce4mLoqavVr1W6M2pkmSIpauEh0cez8hN+5N/u78l15yvzNT5

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):512
                                                              Entropy (8bit):5.222487957477689
                                                              Encrypted:false
                                                              SSDEEP:12:PLv4Yebn9GFUt82d/+2v5LYebn95Z9lSX2Wf0nSit0zWfr1K2SiRh:j4Yeb9ig8cLYeb9zqXcSiVwiRh
                                                              MD5:AE4B167CFCE459F57695E0037924D272
                                                              SHA1:604D27557D9F6FD2922DBBFDEFA5C4E21094E894
                                                              SHA-256:D771B220A9AFAABBF7825395A1D7F0979C76F97FD9E3587DA02CDBCDE8B8C2A5
                                                              SHA-512:4F7B0A05BFCD3B51818E332F01946B102643A3889C9386DEABCC79738E7ED1125CD89118D3D97D784DF1A8ABBA9C5B4F026BA6C162BC57ACC9F318BC9192BC6C
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.282 1df0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/09/05-23:35:55.283 1df0 Recovering log #3.2024/09/05-23:35:55.283 1df0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/09/05-23:36:02.054 1da8 Level-0 table #5: started.2024/09/05-23:36:02.185 1da8 Level-0 table #5: 636529 bytes OK.2024/09/05-23:36:02.186 1da8 Delete type=0 #3.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):512
                                                              Entropy (8bit):5.222487957477689
                                                              Encrypted:false
                                                              SSDEEP:12:PLv4Yebn9GFUt82d/+2v5LYebn95Z9lSX2Wf0nSit0zWfr1K2SiRh:j4Yeb9ig8cLYeb9zqXcSiVwiRh
                                                              MD5:AE4B167CFCE459F57695E0037924D272
                                                              SHA1:604D27557D9F6FD2922DBBFDEFA5C4E21094E894
                                                              SHA-256:D771B220A9AFAABBF7825395A1D7F0979C76F97FD9E3587DA02CDBCDE8B8C2A5
                                                              SHA-512:4F7B0A05BFCD3B51818E332F01946B102643A3889C9386DEABCC79738E7ED1125CD89118D3D97D784DF1A8ABBA9C5B4F026BA6C162BC57ACC9F318BC9192BC6C
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.282 1df0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/09/05-23:35:55.283 1df0 Recovering log #3.2024/09/05-23:35:55.283 1df0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/09/05-23:36:02.054 1da8 Level-0 table #5: started.2024/09/05-23:36:02.185 1da8 Level-0 table #5: 636529 bytes OK.2024/09/05-23:36:02.186 1da8 Delete type=0 #3.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):103
                                                              Entropy (8bit):5.287315490441997
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjGtCSluhFhinvsD8xFxN3erkEtl:scoBY7j6CSluGvlxFDkHl
                                                              MD5:BBF990808A624C34FC58008F69BE5414
                                                              SHA1:8E91249954C47ED58AFAA34373006A9A907A8B87
                                                              SHA-256:2E9DF06E07493794BAE755C1954FDC37401D757916EBFBAA7F0EE64A8FD16E9E
                                                              SHA-512:9F6863BCEE0782B211E95986AEDB74E0563A24D7FE448A7CA56EC94CD489A5BE0999757C25CB75DB6789759DCB81C20236EFB96945165E15E3D139CA4836B844
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator..........7...............&.BLOOM_FILTER:.........DB_VERSION........

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):375520
                                                              Entropy (8bit):5.354094079658537
                                                              Encrypted:false
                                                              SSDEEP:6144:AA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:AFdMyq49tEndBuHltBfdK5WNbsVEziPU
                                                              MD5:DA2E1035D22265CB6D0D691A99F6586A
                                                              SHA1:AC5419DF19C496285DEB82D8264549881EDF8691
                                                              SHA-256:F9A6B2F9019F4AAAB812C8E17706F394748696CA4DC8102F8E680DB909D42A58
                                                              SHA-512:EB1CEAB3DCEFB662CCD774BD86AC5E404A12668E8CED19BE5D182DADF3F28F7225597E2B25A16DEE3E49A7C2AFEDC1CD57F26F472C7D5E9D5984ACAF01B247FB
                                                              Malicious:false
                                                              Preview:...m.................DB_VERSION.1.s.2q...............&QUERY_TIMESTAMP:domains_config_gz2.*.*.13370067363516971..QUERY:domains_config_gz2.*.*..[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):311
                                                              Entropy (8bit):5.145934519304772
                                                              Encrypted:false
                                                              SSDEEP:6:PS2i0M+81923oH+Tcwtk2WwnvB2KLllSlyq2P923oH+Tcwtk2WwnvIFUv:PS2i0XxYebkxwnvFLnSlyv4YebkxwnQg
                                                              MD5:A199F1BDF0581D3FDEE90822AA2548A8
                                                              SHA1:77F4FF9685173A3F25F69A7ED32B734C1F05A08F
                                                              SHA-256:3C182A258667A3FF320DD37AFA322C44E8A6D9624432C33D086E4B5DCB3093E1
                                                              SHA-512:2CB965225DE3A02226C17627E5A072FC4058C10C5837F7965E1647CD17917BB074C3B693C440FB7E87B3B1AAD77CF82C4A389FCB3DA0AC71E5E6189B898E1430
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:01.364 16e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/09/05-23:36:02.020 16e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:modified
                                                              Size (bytes):358860
                                                              Entropy (8bit):5.324626247461174
                                                              Encrypted:false
                                                              SSDEEP:6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R+:C1gAg1zfv2
                                                              MD5:ECB73ACDC9D419491786C68FA911004E
                                                              SHA1:3E7F9516D89D69B76662FF6AC8950EEF2B3095A4
                                                              SHA-256:4B6ECF4FEE87A4B4D83AE79B78F1D1C8DF4E02C5EF10323203AF43AF7E8A3E14
                                                              SHA-512:8E6F77F714F17828550688A1711237FFA35B38C0204265D2ACDFF4E0A6F949EC8020580E5A8DE43C1769EA1A5571D962CCB2ACEB2D45E7B1977F0126CBCE6A16
                                                              Malicious:false
                                                              Preview:{"aee_config":{"ar":{"price_regex":{"ae":"(((ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)))","dz":"(((dzd|da|\\x{062F}\\x{062C})\\s*\\d{1,3})|(\\d{1,3}\\s*(dzd|da|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}|egp)\\s*\\d{1,3})|(\\d{1,3}\\s*(e\\x{00a3}|egp)))","ma":"(((mad|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(mad|dhs|dh)))","sa":"((\\d{1,3}\\s*(sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633}))|((sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633})\\s*\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})|(\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):418
                                                              Entropy (8bit):1.8784775129881184
                                                              Encrypted:false
                                                              SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
                                                              MD5:BF097D724FDF1FCA9CF3532E86B54696
                                                              SHA1:4039A5DD607F9FB14018185F707944FE7BA25EF7
                                                              SHA-256:1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
                                                              SHA-512:31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
                                                              Malicious:false
                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):324
                                                              Entropy (8bit):5.1800021725693695
                                                              Encrypted:false
                                                              SSDEEP:6:P5FrVQ+q2P923oH+Tcwt8aPrqIFUt825Fu8SgZmw+25Fu8SQVkwO923oH+Tcwt8h:Prv4YebL3FUt82G8X/+2G8F5LYebQJ
                                                              MD5:E59AE9D605F533CE7092CEA66C2711F7
                                                              SHA1:00A6BEF532B56D258A244AD0B120DE5AFDE3019B
                                                              SHA-256:979B341C9C1E165D6D691549561674CBC6C411B670113E9DE3C02E41BFB7218D
                                                              SHA-512:FD7C85BAF2C1F770A829CD8725C773B982E43E76222DBB82992C98D0B8D155B2D3AC927E837CC7B36A4245E678692CBE0967C974041B35F7B9143C76654BE04C
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.383 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/09/05-23:35:55.384 1df8 Recovering log #3.2024/09/05-23:35:55.384 1df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):324
                                                              Entropy (8bit):5.1800021725693695
                                                              Encrypted:false
                                                              SSDEEP:6:P5FrVQ+q2P923oH+Tcwt8aPrqIFUt825Fu8SgZmw+25Fu8SQVkwO923oH+Tcwt8h:Prv4YebL3FUt82G8X/+2G8F5LYebQJ
                                                              MD5:E59AE9D605F533CE7092CEA66C2711F7
                                                              SHA1:00A6BEF532B56D258A244AD0B120DE5AFDE3019B
                                                              SHA-256:979B341C9C1E165D6D691549561674CBC6C411B670113E9DE3C02E41BFB7218D
                                                              SHA-512:FD7C85BAF2C1F770A829CD8725C773B982E43E76222DBB82992C98D0B8D155B2D3AC927E837CC7B36A4245E678692CBE0967C974041B35F7B9143C76654BE04C
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.383 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/09/05-23:35:55.384 1df8 Recovering log #3.2024/09/05-23:35:55.384 1df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):418
                                                              Entropy (8bit):1.8784775129881184
                                                              Encrypted:false
                                                              SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
                                                              MD5:BF097D724FDF1FCA9CF3532E86B54696
                                                              SHA1:4039A5DD607F9FB14018185F707944FE7BA25EF7
                                                              SHA-256:1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
                                                              SHA-512:31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
                                                              Malicious:false
                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):5.191368831023514
                                                              Encrypted:false
                                                              SSDEEP:6:P5FiPQ+q2P923oH+Tcwt865IFUt825F/9gZmw+25F/bkQVkwO923oH+Tcwt86+Ud:PKNv4Yeb/WFUt82Ha/+2HT5LYeb/+SJ
                                                              MD5:E43DB849033FE7E31BD314A46DAF3C8A
                                                              SHA1:2B70C745139694F1D9C189DBC12F00EE8F1B69FB
                                                              SHA-256:651CABD6374903821183355DAFA809881346D9175F01211C3C5CE34E8893E5BD
                                                              SHA-512:87DB9112D701DA70A8C66E4E78897D00621E27D4AC97C51886882B875CF08471D0F0C0C2C35A5F50FE99E15BE272DDE6B043F8150D244212A42667ECEEDE91D9
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.388 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/09/05-23:35:55.390 1df8 Recovering log #3.2024/09/05-23:35:55.391 1df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):5.191368831023514
                                                              Encrypted:false
                                                              SSDEEP:6:P5FiPQ+q2P923oH+Tcwt865IFUt825F/9gZmw+25F/bkQVkwO923oH+Tcwt86+Ud:PKNv4Yeb/WFUt82Ha/+2HT5LYeb/+SJ
                                                              MD5:E43DB849033FE7E31BD314A46DAF3C8A
                                                              SHA1:2B70C745139694F1D9C189DBC12F00EE8F1B69FB
                                                              SHA-256:651CABD6374903821183355DAFA809881346D9175F01211C3C5CE34E8893E5BD
                                                              SHA-512:87DB9112D701DA70A8C66E4E78897D00621E27D4AC97C51886882B875CF08471D0F0C0C2C35A5F50FE99E15BE272DDE6B043F8150D244212A42667ECEEDE91D9
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.388 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/09/05-23:35:55.390 1df8 Recovering log #3.2024/09/05-23:35:55.391 1df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):1254
                                                              Entropy (8bit):1.8784775129881184
                                                              Encrypted:false
                                                              SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
                                                              MD5:826B4C0003ABB7604485322423C5212A
                                                              SHA1:6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
                                                              SHA-256:C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
                                                              SHA-512:0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
                                                              Malicious:false
                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):324
                                                              Entropy (8bit):5.151957679115999
                                                              Encrypted:false
                                                              SSDEEP:6:P5f0YlWM+q2P923oH+Tcwt8NIFUt825f0Yz1Zmw+25f0YlWMVkwO923oH+Tcwt8n:P5L+v4YebpFUt82t/+25LV5LYebqJ
                                                              MD5:65CE2EFDA9DE55C0E71F3171C5C499F6
                                                              SHA1:1CFC2DD3E42235B5D2C92E552AB2AE0058F1835C
                                                              SHA-256:C7B387814A6F95B85F37F0C36CA8009AE917604C00EE007690AADF09119D931D
                                                              SHA-512:4617AD2014FDB780048F625747460D74BC5E0F12261F9DD57F9EA1FC6881EBB9AEEB5176C2A529661F8D4BEDFF9B049E7E0342D5AAFC13BBB877FDBB3B27638C
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:56.039 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/05-23:35:56.039 1dac Recovering log #3.2024/09/05-23:35:56.039 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):324
                                                              Entropy (8bit):5.151957679115999
                                                              Encrypted:false
                                                              SSDEEP:6:P5f0YlWM+q2P923oH+Tcwt8NIFUt825f0Yz1Zmw+25f0YlWMVkwO923oH+Tcwt8n:P5L+v4YebpFUt82t/+25LV5LYebqJ
                                                              MD5:65CE2EFDA9DE55C0E71F3171C5C499F6
                                                              SHA1:1CFC2DD3E42235B5D2C92E552AB2AE0058F1835C
                                                              SHA-256:C7B387814A6F95B85F37F0C36CA8009AE917604C00EE007690AADF09119D931D
                                                              SHA-512:4617AD2014FDB780048F625747460D74BC5E0F12261F9DD57F9EA1FC6881EBB9AEEB5176C2A529661F8D4BEDFF9B049E7E0342D5AAFC13BBB877FDBB3B27638C
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:56.039 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/05-23:35:56.039 1dac Recovering log #3.2024/09/05-23:35:56.039 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):429
                                                              Entropy (8bit):5.809210454117189
                                                              Encrypted:false
                                                              SSDEEP:6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
                                                              MD5:5D1D9020CCEFD76CA661902E0C229087
                                                              SHA1:DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
                                                              SHA-256:B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
                                                              SHA-512:5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
                                                              Malicious:false
                                                              Preview:{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):2.445557920945781
                                                              Encrypted:false
                                                              SSDEEP:96:0BCy7zTMmvzelS9nsH4/AztcauuoKwUzT19:mN7zT97sHXzCaPo1UzTP
                                                              MD5:B132D136C264F5BC2B1281343364BAA4
                                                              SHA1:E26D8305BC80D43E146B060A70BC332F319F88A5
                                                              SHA-256:747B8BDA40780B20B74FD1AF3D1302FAE5CC52BCF6168D074B3DF1DE508B6306
                                                              SHA-512:D71C5FB182271A6393483F5399BE7282A5177F144E7030E08883FDE322E9987AE889E31A8974B5BBC8C7AB9DA21B19290F9D7D88730BCF10516B9C6E02E3D6E7
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                              Category:dropped
                                                              Size (bytes):155648
                                                              Entropy (8bit):0.6766262852270971
                                                              Encrypted:false
                                                              SSDEEP:192:/zTEonQ0xhH+bDo3iN0Z2TVJkXBBE3ybazTj:PEghIU3iGAIBBE3qSj
                                                              MD5:810FA274F22DE4BD5CBFFCA081B825D6
                                                              SHA1:997775B7B69D9656E179AE0A90DA28A6BA110DCC
                                                              SHA-256:F9AAC0B33FE0C00565B97D506AEAFB6FA0436C5DE611543084DD99056D5CE131
                                                              SHA-512:F99D351198A79EF0BE9FD6FA0FFA49C821F96F79A7C25798E468497BA243AA96BE7652ED603BE06F7E74BC1B5E1B18153D3BF932D9BF5FAC7A0622D279AD0B4B
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8720
                                                              Entropy (8bit):0.2182285738090153
                                                              Encrypted:false
                                                              SSDEEP:3:DAxvtFlljq7A/mhWJFuQ3yy7IOWUCGAV4dweytllrE9SFcTp4AGbNCV9RUI7:DAxk75fOU4d0Xi99pEYZ
                                                              MD5:AD176C2A3D656E6D1A4D31D3B837C700
                                                              SHA1:F6C8292BA1AECFA7CFCC83EE887B03000C74DB48
                                                              SHA-256:50EEEC1D74E6AAD1FD3BE56B5C8B1150811110F276B89D2BFB651A3E9F65FF09
                                                              SHA-512:5E03C4C15052626ED54BC581A528CDC9031EC3CA192ECE5F0225DB6E581572FC2FB1C4CB135C86BC368073410D5E755701080A1133490FE12605BF89DCAAE3FD
                                                              Malicious:false
                                                              Preview:.............d.e...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):408
                                                              Entropy (8bit):5.255490515400457
                                                              Encrypted:false
                                                              SSDEEP:12:PS2ocv4Yeb8rcHEZrELFUt82S2um/+2S2ua5LYeb8rcHEZrEZSJ:6pm4Yeb8nZrExg8NFkLYeb8nZrEZe
                                                              MD5:EC5AB395FC7688BCA5EC943EB6C4A3F2
                                                              SHA1:F20405BA4D6BAD4F649FB4D8F8CB8BE094F7B0E5
                                                              SHA-256:038B9996C183FCA35A7438894E375A6033FCCC1F2813ADF0A24D6294C3CE889C
                                                              SHA-512:74698F23FADADBBDBBCA2AB7A062AE605FE34E44E39FFC1460567868D6404F81957ADB0B3F485CC4B5125BED3D4555D4BAC367A44C5910524724B3DC15D10D88
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:01.067 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/05-23:36:01.068 1da0 Recovering log #3.2024/09/05-23:36:01.068 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):408
                                                              Entropy (8bit):5.255490515400457
                                                              Encrypted:false
                                                              SSDEEP:12:PS2ocv4Yeb8rcHEZrELFUt82S2um/+2S2ua5LYeb8rcHEZrEZSJ:6pm4Yeb8nZrExg8NFkLYeb8nZrEZe
                                                              MD5:EC5AB395FC7688BCA5EC943EB6C4A3F2
                                                              SHA1:F20405BA4D6BAD4F649FB4D8F8CB8BE094F7B0E5
                                                              SHA-256:038B9996C183FCA35A7438894E375A6033FCCC1F2813ADF0A24D6294C3CE889C
                                                              SHA-512:74698F23FADADBBDBBCA2AB7A062AE605FE34E44E39FFC1460567868D6404F81957ADB0B3F485CC4B5125BED3D4555D4BAC367A44C5910524724B3DC15D10D88
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:01.067 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/05-23:36:01.068 1da0 Recovering log #3.2024/09/05-23:36:01.068 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):336
                                                              Entropy (8bit):5.140770922436111
                                                              Encrypted:false
                                                              SSDEEP:6:P5Ffyq2P923oH+Tcwt8a2jMGIFUt825FPUz1Zmw+25Fg9RkwO923oH+Tcwt8a2jz:PCv4Yeb8EFUt82H+1/+2I75LYeb8bJ
                                                              MD5:FEA97B83A2632D8899EAD09F3DE4B2AE
                                                              SHA1:D818E11AD54769E02A863984E108228DE3381E19
                                                              SHA-256:610A84D1CF8F91251A2674AE9E2BC576FFD98E91E4254AE738C6022B85613E1A
                                                              SHA-512:9CD5C7ACFEB83C9DDD2C53E31974B51DB534AA53F9CAED22FA657895970C25E7AEFE5A431C74E80F558994E7C3C71239D3BBBC8F1E91BF40DD1C3FBE923346C3
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.670 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/05-23:35:55.671 1ea0 Recovering log #3.2024/09/05-23:35:55.675 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):336
                                                              Entropy (8bit):5.140770922436111
                                                              Encrypted:false
                                                              SSDEEP:6:P5Ffyq2P923oH+Tcwt8a2jMGIFUt825FPUz1Zmw+25Fg9RkwO923oH+Tcwt8a2jz:PCv4Yeb8EFUt82H+1/+2I75LYeb8bJ
                                                              MD5:FEA97B83A2632D8899EAD09F3DE4B2AE
                                                              SHA1:D818E11AD54769E02A863984E108228DE3381E19
                                                              SHA-256:610A84D1CF8F91251A2674AE9E2BC576FFD98E91E4254AE738C6022B85613E1A
                                                              SHA-512:9CD5C7ACFEB83C9DDD2C53E31974B51DB534AA53F9CAED22FA657895970C25E7AEFE5A431C74E80F558994E7C3C71239D3BBBC8F1E91BF40DD1C3FBE923346C3
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.670 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/05-23:35:55.671 1ea0 Recovering log #3.2024/09/05-23:35:55.675 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\MediaDeviceSalts

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 6, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):24576
                                                              Entropy (8bit):0.40329461251990195
                                                              Encrypted:false
                                                              SSDEEP:24:TLiCwbvwsw9VwLwcORslcDw3wJ6UwccI5fB5IXWwsdk:TxKX0wxORAmA/U1cEB5IGwsdk
                                                              MD5:7CBA241D28EA908E75AE2ED80749E3D9
                                                              SHA1:C33B45C0472B4B4CE7878AE73CC55BAFF6D77ACE
                                                              SHA-256:DCBDFBEBA48BB741DE4A1A5FA6A72E668F5B9C6565AB4584C1B9BD2B29316715
                                                              SHA-512:D78FCB49D2BFC8F1D9B0F04ED2DF993E6C6EB9D73299C3A8183B57104E7C9B19D83A1B48D5E590EF9DDD31C8A0925FAAF00E23DFB9CC71412467775D11ED5D5F
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g...p."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\10402c19-592d-441c-8837-e9e906fa3a79.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):188
                                                              Entropy (8bit):5.294721148477355
                                                              Encrypted:false
                                                              SSDEEP:3:YWRAWNjYoUTmdDDlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqZiQA:YWyWNsJTqDDlBv31dB8wXwlmUUAnIMpE
                                                              MD5:1240BB2FD0BC5E7D1E9CAE108E0DEECE
                                                              SHA1:34377DA3563F9D48733F7ACDE956A1E456DCC055
                                                              SHA-256:656E4084EB93CCAA5BA9B747B1CFD367B30221F44498533BCD0EF17BAFF18329
                                                              SHA-512:F36EF4B5E4528B37C35270EAA2963B3DA30D657F994B589F317AE6FEA309702C663A35B6DC706B2837B13F4867E9D100DDB0C90076C6D1501769361DDBB94AEA
                                                              Malicious:false
                                                              Preview:{"sts":[{"expiry":1757129825.916708,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1725593825.916712}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\11323bec-f253-4e65-8bcf-4fe52bd9199b.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):188
                                                              Entropy (8bit):5.293090794825989
                                                              Encrypted:false
                                                              SSDEEP:3:YWRAWNjYGddTTUUDKWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqR:YWyWNsK1U+DlBv31dB8wXwlmUUAnIMpz
                                                              MD5:9268C08B1EF04117D7A7EB6AC162BC1F
                                                              SHA1:98AE183312AF7108F3D23F255ABA61E9F55515D9
                                                              SHA-256:80182FB102763AE4E3A858B44C3DAFB0497312134B6318F083C236921515929F
                                                              SHA-512:346F81F93DDE3D0ABAE1E69E21BA99A873A8B5F7845292D4E3B5E6F03D9F59C0A4585C49D20AC4805988580A5EFD692F0D528519EA5F232DAB8D4652A6114F93
                                                              Malicious:false
                                                              Preview:{"sts":[{"expiry":1757129765.886611,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1725593765.886615}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\343abc75-d77b-49ed-85c5-3db39a699f59.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):1.0831176149154338
                                                              Encrypted:false
                                                              SSDEEP:48:T2dKLopF+SawLUO1Xj8Bm0lniBVdo9b4pOFyPr:ige+AumkiRu8r
                                                              MD5:602614184F39E0B591684F1669791CF6
                                                              SHA1:4914D045F0B5613C65933B8EE2AC6D40F8796348
                                                              SHA-256:FA059303DCFD63B24C37EB966CF38DBA756E2F280763EFA72AD347BBEF087C54
                                                              SHA-512:4AEADF031C81CF1FF07DC41296D372B50BC09A2BFB93311850884484D51BF148E9AD9180D01CA16461C169FD8B44EC70663BC09CB844352A8EAF582AAC790513
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2917
                                                              Entropy (8bit):5.312607270428978
                                                              Encrypted:false
                                                              SSDEEP:48:YcgCzsSts+Rgsql/C5sefc7leeEs9aZkEsC4Rse+Hds9+HplesY4bxo+:FNvRs/m2kehaZkO4Z424pU4Vo+
                                                              MD5:B5A5E9FFCD87F2DED3ADF10BAB2DB393
                                                              SHA1:2B4366784D7F2FCE60BF2DCEC0C3D7D7BF9B5B7A
                                                              SHA-256:6E32FBC17DE6B04AF783FBE5156FB0EF20C9F2B95BE2279DC2710C9625C14742
                                                              SHA-512:4D60154082F678455EA070C65C837036A12CB41DDD1FD6984CC274A7C64ACE58F350760B60642338383EF65AE82053BA34A8E152E38D25E07129D24C41D16C0C
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659357526057","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659360139420","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13370160961312946","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659362135372","port":443,"protocol_str":"quic"}],"anonymization":["

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4b1b8.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2917
                                                              Entropy (8bit):5.312607270428978
                                                              Encrypted:false
                                                              SSDEEP:48:YcgCzsSts+Rgsql/C5sefc7leeEs9aZkEsC4Rse+Hds9+HplesY4bxo+:FNvRs/m2kehaZkO4Z424pU4Vo+
                                                              MD5:B5A5E9FFCD87F2DED3ADF10BAB2DB393
                                                              SHA1:2B4366784D7F2FCE60BF2DCEC0C3D7D7BF9B5B7A
                                                              SHA-256:6E32FBC17DE6B04AF783FBE5156FB0EF20C9F2B95BE2279DC2710C9625C14742
                                                              SHA-512:4D60154082F678455EA070C65C837036A12CB41DDD1FD6984CC274A7C64ACE58F350760B60642338383EF65AE82053BA34A8E152E38D25E07129D24C41D16C0C
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659357526057","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659360139420","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13370160961312946","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659362135372","port":443,"protocol_str":"quic"}],"anonymization":["

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                              Category:dropped
                                                              Size (bytes):36864
                                                              Entropy (8bit):1.3295291021681384
                                                              Encrypted:false
                                                              SSDEEP:96:uIEumQv8m1ccnvS6cDo2dQF2YQ9UZn1gVRVkI:uIEumQv8m1ccnvS6p282rUZnwd
                                                              MD5:E3128979CB5A89969F5885FA61FDCCED
                                                              SHA1:11D7105FF8FC42029185C8182A1FBF97D61EE654
                                                              SHA-256:F30285173543F4F6575B04F1DE96121D01BA774AD529267283CB8A7B9B8B6D8E
                                                              SHA-512:4856CD8769E538B2ACBF3600CDFB7AA95677D42D904BA710443106EE91E6CFA2C8B7AD224DCBD5DD5A287EA2663FEBFD7D312E3B44188C72474154360B7681B4
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF32c03.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF33b64.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF33de5.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):4.1275671571169275
                                                              Encrypted:false
                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                              Malicious:false
                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):188
                                                              Entropy (8bit):5.293090794825989
                                                              Encrypted:false
                                                              SSDEEP:3:YWRAWNjYGddTTUUDKWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqR:YWyWNsK1U+DlBv31dB8wXwlmUUAnIMpz
                                                              MD5:9268C08B1EF04117D7A7EB6AC162BC1F
                                                              SHA1:98AE183312AF7108F3D23F255ABA61E9F55515D9
                                                              SHA-256:80182FB102763AE4E3A858B44C3DAFB0497312134B6318F083C236921515929F
                                                              SHA-512:346F81F93DDE3D0ABAE1E69E21BA99A873A8B5F7845292D4E3B5E6F03D9F59C0A4585C49D20AC4805988580A5EFD692F0D528519EA5F232DAB8D4652A6114F93
                                                              Malicious:false
                                                              Preview:{"sts":[{"expiry":1757129765.886611,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1725593765.886615}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF44fe1.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):188
                                                              Entropy (8bit):5.293090794825989
                                                              Encrypted:false
                                                              SSDEEP:3:YWRAWNjYGddTTUUDKWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqR:YWyWNsK1U+DlBv31dB8wXwlmUUAnIMpz
                                                              MD5:9268C08B1EF04117D7A7EB6AC162BC1F
                                                              SHA1:98AE183312AF7108F3D23F255ABA61E9F55515D9
                                                              SHA-256:80182FB102763AE4E3A858B44C3DAFB0497312134B6318F083C236921515929F
                                                              SHA-512:346F81F93DDE3D0ABAE1E69E21BA99A873A8B5F7845292D4E3B5E6F03D9F59C0A4585C49D20AC4805988580A5EFD692F0D528519EA5F232DAB8D4652A6114F93
                                                              Malicious:false
                                                              Preview:{"sts":[{"expiry":1757129765.886611,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1725593765.886615}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7d7e572-679c-4ad6-b351-1e95ac4a3dbb.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):4.1275671571169275
                                                              Encrypted:false
                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                              Malicious:false
                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b5efcbf3-8d75-4d8e-86df-64ce15e80c96.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b72847ec-711a-46eb-90ac-6ba80f277b02.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8647186-267b-4d12-be57-7d285fafded7.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2917
                                                              Entropy (8bit):5.312607270428978
                                                              Encrypted:false
                                                              SSDEEP:48:YcgCzsSts+Rgsql/C5sefc7leeEs9aZkEsC4Rse+Hds9+HplesY4bxo+:FNvRs/m2kehaZkO4Z424pU4Vo+
                                                              MD5:B5A5E9FFCD87F2DED3ADF10BAB2DB393
                                                              SHA1:2B4366784D7F2FCE60BF2DCEC0C3D7D7BF9B5B7A
                                                              SHA-256:6E32FBC17DE6B04AF783FBE5156FB0EF20C9F2B95BE2279DC2710C9625C14742
                                                              SHA-512:4D60154082F678455EA070C65C837036A12CB41DDD1FD6984CC274A7C64ACE58F350760B60642338383EF65AE82053BA34A8E152E38D25E07129D24C41D16C0C
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659357526057","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659360139420","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13370160961312946","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659362135372","port":443,"protocol_str":"quic"}],"anonymization":["

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b9f95f3c-43cf-4ebf-baf8-3c9bdff7753f.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5ab0441-99c3-4bd1-81d2-d6aa992ad438.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2917
                                                              Entropy (8bit):5.312251123732726
                                                              Encrypted:false
                                                              SSDEEP:48:YcgCzsSts+Rgsql/C5sefc7leeEs9aZkEsC4Rse+Hds9+HplesY4bx9+:FNvRs/m2kehaZkO4Z424pU4V9+
                                                              MD5:0BB506834710DDEBE92AD4A13E542F06
                                                              SHA1:1D7191E8EE5B2995CFB8F17D6444CE87F2304F7A
                                                              SHA-256:1548FCDE0B51AC2639AD1E4F62057BDC4F751D01682FBA83B72275FB49115046
                                                              SHA-512:95BB086EE7E5ACA2C789C62723FD323BF63148F953E356A14BCFA63DFB1ADB648EE18D11DA418844CABAF7C8DA6363831693759B3D2B728C12389381A3BAE8C3
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659357526057","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659360139420","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13370160961312946","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372659362135372","port":443,"protocol_str":"quic"}],"anonymization":["

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):0.7391107375212417
                                                              Encrypted:false
                                                              SSDEEP:12:TLSnAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isvhldvd0dtdjiG1d6XfN:TLSOUOq0afDdWec9sJAhvlXI7J5fc
                                                              MD5:A74BFDCBFB880F469AD54BEF7B1B0C88
                                                              SHA1:0012DD82FEB43839A30557EAF9E8DB2EB7259142
                                                              SHA-256:63DFF3D10BF10F8F5326776956AF6DE1463CF0A14792C4451D4A76EFA1BF4BA2
                                                              SHA-512:203FC220BF05344052340CCC6F77233669C200FDC6596EEE6F5D1E2203328D7D116BF07DE664D1D60EA2CD96F006406A9F0A2035BFAA86C93A103193E6EA4583
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):9749
                                                              Entropy (8bit):5.115450295286968
                                                              Encrypted:false
                                                              SSDEEP:192:st3kdzss+tsZihUkAD+3K8obV+FIjQA66WcaFIMYAPnYJ:st34ss+tfh4DnbGEQx6WcaTYJ
                                                              MD5:621A72041821A499900D3E3B7AB9AFD0
                                                              SHA1:91EFB590A76E3CB7D2684E8876643D3B80B9FCA6
                                                              SHA-256:7F67231AF4C693496B133C6B20A094FE881CFF6E18A5DEE50088827AE0153B79
                                                              SHA-512:EEE6A2737ABD12D54911ED4F150564238FB7CDB53EB95B5B5C98157E353A3A27A4DC0836C35900FB5242DE5770D8906489EC8818655BC218F81A8632A6FEBA7E
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370067355800565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF36533.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):9749
                                                              Entropy (8bit):5.115450295286968
                                                              Encrypted:false
                                                              SSDEEP:192:st3kdzss+tsZihUkAD+3K8obV+FIjQA66WcaFIMYAPnYJ:st34ss+tfh4DnbGEQx6WcaTYJ
                                                              MD5:621A72041821A499900D3E3B7AB9AFD0
                                                              SHA1:91EFB590A76E3CB7D2684E8876643D3B80B9FCA6
                                                              SHA-256:7F67231AF4C693496B133C6B20A094FE881CFF6E18A5DEE50088827AE0153B79
                                                              SHA-512:EEE6A2737ABD12D54911ED4F150564238FB7CDB53EB95B5B5C98157E353A3A27A4DC0836C35900FB5242DE5770D8906489EC8818655BC218F81A8632A6FEBA7E
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370067355800565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3b0e2.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):9749
                                                              Entropy (8bit):5.115450295286968
                                                              Encrypted:false
                                                              SSDEEP:192:st3kdzss+tsZihUkAD+3K8obV+FIjQA66WcaFIMYAPnYJ:st34ss+tfh4DnbGEQx6WcaTYJ
                                                              MD5:621A72041821A499900D3E3B7AB9AFD0
                                                              SHA1:91EFB590A76E3CB7D2684E8876643D3B80B9FCA6
                                                              SHA-256:7F67231AF4C693496B133C6B20A094FE881CFF6E18A5DEE50088827AE0153B79
                                                              SHA-512:EEE6A2737ABD12D54911ED4F150564238FB7CDB53EB95B5B5C98157E353A3A27A4DC0836C35900FB5242DE5770D8906489EC8818655BC218F81A8632A6FEBA7E
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370067355800565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42612.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):9749
                                                              Entropy (8bit):5.115450295286968
                                                              Encrypted:false
                                                              SSDEEP:192:st3kdzss+tsZihUkAD+3K8obV+FIjQA66WcaFIMYAPnYJ:st34ss+tfh4DnbGEQx6WcaTYJ
                                                              MD5:621A72041821A499900D3E3B7AB9AFD0
                                                              SHA1:91EFB590A76E3CB7D2684E8876643D3B80B9FCA6
                                                              SHA-256:7F67231AF4C693496B133C6B20A094FE881CFF6E18A5DEE50088827AE0153B79
                                                              SHA-512:EEE6A2737ABD12D54911ED4F150564238FB7CDB53EB95B5B5C98157E353A3A27A4DC0836C35900FB5242DE5770D8906489EC8818655BC218F81A8632A6FEBA7E
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370067355800565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:modified
                                                              Size (bytes):83572
                                                              Entropy (8bit):5.664042081399982
                                                              Encrypted:false
                                                              SSDEEP:1536:nL0/Ry7vm2lhq4ljc+PjfOzBu+RMDVogUlcPCcBjjmny8dLA8j7baD7:nL6yLm2fq4pc+rCAogU2CcBjj3YAg7mn
                                                              MD5:40CECD6BA64163BF61F244389D299222
                                                              SHA1:44E128C1EEDBD23CB09CAF98930B9AEA916514D1
                                                              SHA-256:A7030D02D81C93F77161B88CD6EE27D2EE8B7354B2B96F11A91D289E038945EF
                                                              SHA-512:5C4A3159EC5DBBEC3541C0A5F4EDA9DC2E799AE45F71955370E783E5FC1C7570AD2BE26447B2A68AFEEB27247A3CFBE03E1E391D3434518F2D010422BECEEA64
                                                              Malicious:false
                                                              Preview:...m.................DB_VERSION.15.,.j...............(QUERY_TIMESTAMP:product_category_en1.*.*.13370067366003245..QUERY:product_category_en1.*.*..[{"name":"product_category_en","url":"https://edgeassetservice.azureedge.net/assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories","version":{"major":1,"minor":0,"patch":0},"hash":"r2jWYy3aqoi3+S+aPyOSfXOCPeLSy5AmAjNHvYRv9Hg=","size":82989}]...yg~..............!ASSET_VERSION:product_category_en.1.0.0..ASSET:product_category_en...."..3....Car & Garage..Belts & Hoses.#..+....Sports & Outdoors..Air Pumps.!.."....Car & Garage..Body Styling.4..5./..Gourmet Food & Chocolate..Spices & Seasonings.'..,."..Sports & Outdoors..Sleeping Gear.!..6....Lawn & Garden..Hydroponics.9.a.5..Books & Magazines. Gay & Lesbian Interest Magazines....+....Office Products..Pins.,..3.'..Kitchen & Housewares..Coffee Grinders.$..#....Computing..Enterprise Servers.#..&....Home Furnishings..Footboards.6...2..Books & Magazines..Computer & Internet Magazines.)..

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):309
                                                              Entropy (8bit):5.184898908117092
                                                              Encrypted:false
                                                              SSDEEP:6:PSybj+RM1923oH+TcwtgctZQInvB2KLllSyMq2P923oH+TcwtgctZQInvIFUv:PSyP+RhYebgGZznvFLnSyMv4YebgGZzp
                                                              MD5:4BDC85DA90B65CCA14FA8AD75A420F22
                                                              SHA1:9432EBA7B4DF558EC08B96AF5455713C9B9FA55B
                                                              SHA-256:6E92D2B325740847A421E13E331E8041EC9858121FF2DB9E3CCA96AAC2A73256
                                                              SHA-512:2AC27EEC8277EB5B716B92FAE908FA39206DB1D23390AA9EDC077BC5B81D04A2A7C3A24FF05B7F42AD62AC7848E5EEBAA2472A8C73BE6CC9B744312076CF3E49
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:05.247 25b4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db since it was missing..2024/09/05-23:36:05.306 25b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):26889
                                                              Entropy (8bit):5.576541992236378
                                                              Encrypted:false
                                                              SSDEEP:768:sp3vBvWPdBfYH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNRr4UVrwVWpsbtuL:sp3vBvWPdBfYHu1jaxNR0UeVZbtc
                                                              MD5:4D7206F92CEC5C9CCF8FB9D782BA971C
                                                              SHA1:C4AC32F08B728E07D86E04ABAE0A618D22993D1D
                                                              SHA-256:B3ED08528202E86ADB91CEA0D2FB3C7955F83FE53D1C1C511A9356FE7217ED5A
                                                              SHA-512:11DBF27D202231FD2EDD88E737A2480F2BDD40D5E063B272B6BD75E4222537786D7F1C4FD6E9DF46DFC7AF2AFEE0D961FFC13FDAA86C737D03C8C6231BCFFBB3
                                                              Malicious:false
                                                              Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370067355253838","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370067355253838","location":5,"ma

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF364f5.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):26889
                                                              Entropy (8bit):5.576541992236378
                                                              Encrypted:false
                                                              SSDEEP:768:sp3vBvWPdBfYH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNRr4UVrwVWpsbtuL:sp3vBvWPdBfYHu1jaxNR0UeVZbtc
                                                              MD5:4D7206F92CEC5C9CCF8FB9D782BA971C
                                                              SHA1:C4AC32F08B728E07D86E04ABAE0A618D22993D1D
                                                              SHA-256:B3ED08528202E86ADB91CEA0D2FB3C7955F83FE53D1C1C511A9356FE7217ED5A
                                                              SHA-512:11DBF27D202231FD2EDD88E737A2480F2BDD40D5E063B272B6BD75E4222537786D7F1C4FD6E9DF46DFC7AF2AFEE0D961FFC13FDAA86C737D03C8C6231BCFFBB3
                                                              Malicious:false
                                                              Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370067355253838","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370067355253838","location":5,"ma

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):440
                                                              Entropy (8bit):4.5699109989352555
                                                              Encrypted:false
                                                              SSDEEP:12:S+a8ljljljljlKU2pbL3+CZQ32pbLSnGz3A/XkAvkAvkAv:Ra0ZZZZKU2le2cG0Xk8k8k8
                                                              MD5:1B78DFC5F0A9DD62AB2C5CA900CFA19C
                                                              SHA1:BF9CA8B3BA5C7709419D141AFB46E834A4F33DA7
                                                              SHA-256:05A270153141CF009EF80C60029F74273585AB186DA5E261DD56ADFBEC24EBAF
                                                              SHA-512:10F74C9F3F1D2C5B279A659F80804B62A37EC263D39C52E5E711B779386BECEE917780527C76A14FFC387D7260E96F5BB136C95EF4847AF72AB50A5EF8DC8E38
                                                              Malicious:false
                                                              Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............6=..j................next-map-id.1.Knamespace-c3d9560d_ec59_43d2_aef5_ad095aee5bcd-https://accounts.google.com/.0#n'#k................next-map-id.2.Lnamespace-c3d9560d_ec59_43d2_aef5_ad095aee5bcd-https://accounts.youtube.com/.1. .................. .................. .................. .................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):324
                                                              Entropy (8bit):5.136373527293025
                                                              Encrypted:false
                                                              SSDEEP:6:P5Fkyq2P923oH+TcwtrQMxIFUt825Ff1Zmw+25F5lRkwO923oH+TcwtrQMFLJ:Phv4YebCFUt82H1/+2Bz5LYebtJ
                                                              MD5:79E727413C3D2C54A79126913AF71039
                                                              SHA1:A18DDAF9487D2733F7BCD41E08AD18199F39FE79
                                                              SHA-256:57DE170F81B21A0C8387E2DACC367230CBCAD7D9E868FA055C66452AD7947FD0
                                                              SHA-512:9D0616E8A44AE0E7AD22E120732EF426B3EF84889FEC320AEB7E360F9646B6322A348868D77C0E24CDE76BC0BAA696D1855B9E4E0DDFC8C03755AE6A3C52A0EC
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.785 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/05-23:35:55.786 1ea0 Recovering log #3.2024/09/05-23:35:55.788 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):324
                                                              Entropy (8bit):5.136373527293025
                                                              Encrypted:false
                                                              SSDEEP:6:P5Fkyq2P923oH+TcwtrQMxIFUt825Ff1Zmw+25F5lRkwO923oH+TcwtrQMFLJ:Phv4YebCFUt82H1/+2Bz5LYebtJ
                                                              MD5:79E727413C3D2C54A79126913AF71039
                                                              SHA1:A18DDAF9487D2733F7BCD41E08AD18199F39FE79
                                                              SHA-256:57DE170F81B21A0C8387E2DACC367230CBCAD7D9E868FA055C66452AD7947FD0
                                                              SHA-512:9D0616E8A44AE0E7AD22E120732EF426B3EF84889FEC320AEB7E360F9646B6322A348868D77C0E24CDE76BC0BAA696D1855B9E4E0DDFC8C03755AE6A3C52A0EC
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.785 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/05-23:35:55.786 1ea0 Recovering log #3.2024/09/05-23:35:55.788 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13370067357758337

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):9329
                                                              Entropy (8bit):4.065436682423009
                                                              Encrypted:false
                                                              SSDEEP:192:3lFRzThs3P/4Ez6zTb343P/4EjzTNp3/xed/aI3P/4EaE:VFR+/4Euk/4EDNpq/5/4E
                                                              MD5:C86ADFD05D144086C2449B4E615340C1
                                                              SHA1:B68092E02FCB49B46C7E343C2A43ECF7B4669D6B
                                                              SHA-256:A90ABA4FC65CFBC6338983D5E2173D52FD1A461150692B31129DE78A96E12C2F
                                                              SHA-512:BD60C4A6A4D583053D6A75E76AA6C7E4C315C81160315DA3C0CD85E213B93B147621185609348C482A7BE67E40037860379421D2781214F053710FD4C7925BDB
                                                              Malicious:false
                                                              Preview:SNSS........%.T............%.T......".%.T............%.T........%.T........%.T........%.T....!...%.T................................%.T.%.T1..,....%.T$...c3d9560d_ec59_43d2_aef5_ad095aee5bcd....%.T........%.T................%.T....%.T........................%.T....................5..0....%.T&...{98952893-68FF-4A5D-A164-705C709ED3DB}......%.T........%.T............................%.T................%.To...Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36.........................Not;A=Brand.....8.......Chromium....117.....Google Chrome.......117.........Not;A=Brand.....8.0.0.0.....Chromium....117.0.5938.132......Google Chrome.......117.0.5938.132......117.0.5938.132......Windows.....10.0.0......x86.............64.....................%.T................%.To...Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36.........................Not;A=Brand.....8.......Chromium...

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):0.44194574462308833
                                                              Encrypted:false
                                                              SSDEEP:12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
                                                              MD5:B35F740AA7FFEA282E525838EABFE0A6
                                                              SHA1:A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
                                                              SHA-256:5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
                                                              SHA-512:05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):352
                                                              Entropy (8bit):5.1565876567365
                                                              Encrypted:false
                                                              SSDEEP:6:P5F1tn4q2P923oH+Tcwt7Uh2ghZIFUt825F1OLJZmw+25F1OLDkwO923oH+Tcwts:Pnn4v4YebIhHh2FUt820LJ/+20LD5LYz
                                                              MD5:2B44D419564500321D6C91D19F584AAF
                                                              SHA1:77C7D7CD0EE288C88D6EFB9352DCC68DDA231382
                                                              SHA-256:E6AD4E98500F8204FB66AC9EF2F9F13E4073CD4FB454AAE84DA0DA0AF8833330
                                                              SHA-512:4558A052D76B6B6A6C742C9C5418C41BF2EFF5763218FF353A1BA078853ED2AF8D4216E9834D26CBC7611C2FE5AFFFBEC40EE6F0E6F1DD82200B2C296FFA1D38
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.337 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/05-23:35:55.338 1df4 Recovering log #3.2024/09/05-23:35:55.338 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):352
                                                              Entropy (8bit):5.1565876567365
                                                              Encrypted:false
                                                              SSDEEP:6:P5F1tn4q2P923oH+Tcwt7Uh2ghZIFUt825F1OLJZmw+25F1OLDkwO923oH+Tcwts:Pnn4v4YebIhHh2FUt820LJ/+20LD5LYz
                                                              MD5:2B44D419564500321D6C91D19F584AAF
                                                              SHA1:77C7D7CD0EE288C88D6EFB9352DCC68DDA231382
                                                              SHA-256:E6AD4E98500F8204FB66AC9EF2F9F13E4073CD4FB454AAE84DA0DA0AF8833330
                                                              SHA-512:4558A052D76B6B6A6C742C9C5418C41BF2EFF5763218FF353A1BA078853ED2AF8D4216E9834D26CBC7611C2FE5AFFFBEC40EE6F0E6F1DD82200B2C296FFA1D38
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.337 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/05-23:35:55.338 1df4 Recovering log #3.2024/09/05-23:35:55.338 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):0.0012471779557650352
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):0.0012471779557650352
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):434
                                                              Entropy (8bit):5.234983503538872
                                                              Encrypted:false
                                                              SSDEEP:12:P0Ov4YebvqBQFUt82O1/+2r5LYebvqBvJ:B4YebvZg8JTLYebvk
                                                              MD5:FA3E25BCBA71A72C7222451C58DF30B7
                                                              SHA1:B94D9B8A122C1B67DF0D1705960D991343C633C3
                                                              SHA-256:9FE54C05EF6333267624C5397807657C5A433ED163ADBFDBF8260A8F01FAA828
                                                              SHA-512:BDA598DADFCBC3DE0328680EC94FA757EBB0C9153BAB8AAA7AC1CF2A4EB067788B3D650B442A76BE7BFB834D02725C97E8408803E575E9CD7CB646E7BA6D84D4
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:56.179 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/05-23:35:56.180 1ea0 Recovering log #3.2024/09/05-23:35:56.183 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):434
                                                              Entropy (8bit):5.234983503538872
                                                              Encrypted:false
                                                              SSDEEP:12:P0Ov4YebvqBQFUt82O1/+2r5LYebvqBvJ:B4YebvZg8JTLYebvk
                                                              MD5:FA3E25BCBA71A72C7222451C58DF30B7
                                                              SHA1:B94D9B8A122C1B67DF0D1705960D991343C633C3
                                                              SHA-256:9FE54C05EF6333267624C5397807657C5A433ED163ADBFDBF8260A8F01FAA828
                                                              SHA-512:BDA598DADFCBC3DE0328680EC94FA757EBB0C9153BAB8AAA7AC1CF2A4EB067788B3D650B442A76BE7BFB834D02725C97E8408803E575E9CD7CB646E7BA6D84D4
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:56.179 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/05-23:35:56.180 1ea0 Recovering log #3.2024/09/05-23:35:56.183 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1be97079-ec93-4f0b-8292-f88b947c47eb.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7eaf7e8a-d061-442f-8a5c-c75635519e38.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):144
                                                              Entropy (8bit):4.842082263530856
                                                              Encrypted:false
                                                              SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
                                                              MD5:ABE81C38891A875B52127ACE9C314105
                                                              SHA1:8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
                                                              SHA-256:6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
                                                              SHA-512:B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF33b74.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF33de5.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):4.1275671571169275
                                                              Encrypted:false
                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                              Malicious:false
                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
                                                              Category:dropped
                                                              Size (bytes):36864
                                                              Entropy (8bit):0.3886039372934488
                                                              Encrypted:false
                                                              SSDEEP:24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
                                                              MD5:DEA619BA33775B1BAEEC7B32110CB3BD
                                                              SHA1:949B8246021D004B2E772742D34B2FC8863E1AAA
                                                              SHA-256:3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
                                                              SHA-512:7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bb0a5108-4a89-4b41-95ed-fbb5f9e678c8.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):4.1275671571169275
                                                              Encrypted:false
                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                              Malicious:false
                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e2f84738-a8f6-4490-81a1-d0b6df0aa0dc.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f8a63d62-b8e5-42d2-97c5-2130dd94b0a6.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:modified
                                                              Size (bytes):144
                                                              Entropy (8bit):4.842082263530856
                                                              Encrypted:false
                                                              SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
                                                              MD5:ABE81C38891A875B52127ACE9C314105
                                                              SHA1:8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
                                                              SHA-256:6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
                                                              SHA-512:B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):80
                                                              Entropy (8bit):3.4921535629071894
                                                              Encrypted:false
                                                              SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                              MD5:69449520FD9C139C534E2970342C6BD8
                                                              SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                              SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                              SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                              Malicious:false
                                                              Preview:*...#................version.1..namespace-..&f.................&f...............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):422
                                                              Entropy (8bit):5.238440159335222
                                                              Encrypted:false
                                                              SSDEEP:12:PSyv4YebvqBZFUt82SO1/+2SEw5LYebvqBaJ:6Y4Yebvyg8NOkXLYebvL
                                                              MD5:6D1F82C41CED044A301C7F18A9C34A14
                                                              SHA1:74BA5AD01894C8C4008EE958D3791121FBC62EFF
                                                              SHA-256:0A2F5724AA3429738BB789A74F4CF567A740B3D8327179DA71FB92912F8D83EB
                                                              SHA-512:DFB49CE814C8E7BB2594E103AA8104EC479F7C26694C38C7724AE7FF1B0A1A15B9B0AE90295ED2A9215BAAA6B5BB2D83B140A0DC8ED8AA6568D235F35E573587
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:15.742 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/05-23:36:15.743 1ea0 Recovering log #3.2024/09/05-23:36:15.746 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):422
                                                              Entropy (8bit):5.238440159335222
                                                              Encrypted:false
                                                              SSDEEP:12:PSyv4YebvqBZFUt82SO1/+2SEw5LYebvqBaJ:6Y4Yebvyg8NOkXLYebvL
                                                              MD5:6D1F82C41CED044A301C7F18A9C34A14
                                                              SHA1:74BA5AD01894C8C4008EE958D3791121FBC62EFF
                                                              SHA-256:0A2F5724AA3429738BB789A74F4CF567A740B3D8327179DA71FB92912F8D83EB
                                                              SHA-512:DFB49CE814C8E7BB2594E103AA8104EC479F7C26694C38C7724AE7FF1B0A1A15B9B0AE90295ED2A9215BAAA6B5BB2D83B140A0DC8ED8AA6568D235F35E573587
                                                              Malicious:false
                                                              Preview:2024/09/05-23:36:15.742 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/05-23:36:15.743 1ea0 Recovering log #3.2024/09/05-23:36:15.746 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):5.198175383841345
                                                              Encrypted:false
                                                              SSDEEP:6:P5FzJSQL+q2P923oH+TcwtpIFUt825F1JSG1Zmw+25F1JSQLVkwO923oH+TcwtaQ:PbJjyv4YebmFUt82T/+2PR5LYebaUJ
                                                              MD5:A131993B90C72347DA8EFDFD22F1A3A8
                                                              SHA1:B2D928EF61F90A042546BB898B9E7E70645B9C94
                                                              SHA-256:AE1E20FDADD3F6DF1757FCD98395A5A6AD65338886A8D979B450A2AC4A97E9F7
                                                              SHA-512:D892CF62C6D229EC1BACEA433DC11F8B04C3EE0DEFC7830AEB09AD2C40437D271D2BB7141401F1034CD12491E2D948274B7E05FCFC306E7B36BAA40AB86CC8D2
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.257 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/05-23:35:55.251 1da8 Recovering log #3.2024/09/05-23:35:55.251 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):5.198175383841345
                                                              Encrypted:false
                                                              SSDEEP:6:P5FzJSQL+q2P923oH+TcwtpIFUt825F1JSG1Zmw+25F1JSQLVkwO923oH+TcwtaQ:PbJjyv4YebmFUt82T/+2PR5LYebaUJ
                                                              MD5:A131993B90C72347DA8EFDFD22F1A3A8
                                                              SHA1:B2D928EF61F90A042546BB898B9E7E70645B9C94
                                                              SHA-256:AE1E20FDADD3F6DF1757FCD98395A5A6AD65338886A8D979B450A2AC4A97E9F7
                                                              SHA-512:D892CF62C6D229EC1BACEA433DC11F8B04C3EE0DEFC7830AEB09AD2C40437D271D2BB7141401F1034CD12491E2D948274B7E05FCFC306E7B36BAA40AB86CC8D2
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.257 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/05-23:35:55.251 1da8 Recovering log #3.2024/09/05-23:35:55.251 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):131072
                                                              Entropy (8bit):0.005567161523650777
                                                              Encrypted:false
                                                              SSDEEP:3:ImtVF+RrZCVXhI/UDC:IiVEXWKUDC
                                                              MD5:197B20913EBEFA00FB52780B9B8ACFEC
                                                              SHA1:9E1ACECB0ECBB578B0074F98BE00E092E24D7F08
                                                              SHA-256:9C9567F7512A9D6777591E115E6901576E85976522B9C686A1C4E5749BEA60AE
                                                              SHA-512:5F1C649E24A1B9882DAF73A507084611FEDFB9DDF156388C74D6ABBE803D88F4950ED81CA0880CCC3123A7A9A8E30986C2E35FA24577E8A022F40AAAF66E2950
                                                              Malicious:false
                                                              Preview:VLnk.....?......?......+................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                              Category:dropped
                                                              Size (bytes):196608
                                                              Entropy (8bit):1.2648193128415233
                                                              Encrypted:false
                                                              SSDEEP:384:8/2qOB1nxCkMdtSAELyKOMq+8yC8F/YfU5m+OlTLVumQ:Bq+n0JH9ELyKOMq+8y9/Owr
                                                              MD5:BF52DD81BBB78D8C5B3151D3BD2CD519
                                                              SHA1:A83E2EB66BCB977AAE52F41C21B4A2DCBFB96537
                                                              SHA-256:98B49C68685694F8C6D7EA2119C283DD5B10F94860E06AEBDF1E25178FF54A63
                                                              SHA-512:BE66AF943845BF220FBC9B85E9470A159A81AF76FCC23E952C702C9E1F1ABB8C91019AE4C35B9BA6CDA6D01F48B194525BEB82141CE3FAA7C3BD818A7E2C9DB5
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 11
                                                              Category:dropped
                                                              Size (bytes):14336
                                                              Entropy (8bit):1.4196421522654032
                                                              Encrypted:false
                                                              SSDEEP:48:fK3tjkSdj5IUltGhp22iSBgF2RyUTuEcqd+2RyUTuwxj/:ftSjGhp22iSNzTEqd5zTP
                                                              MD5:9A53F3291146860EA9A435A4D33674B5
                                                              SHA1:5CE46E5592B15D55D402E09AFA45A706FE41457F
                                                              SHA-256:EC0E3194C8D679C4F28ABC70883B3871E7F85AB3AA04A80CF7DAD854C90F6E38
                                                              SHA-512:4C76063A009332717BE77B7251D350F91E019FCDC3533B55BDD2799082DA57667BD925E051DD12CB16F1DD2CB9800516BABA2FABB408B9153887C3846154567B
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):40960
                                                              Entropy (8bit):0.41235120905181716
                                                              Encrypted:false
                                                              SSDEEP:48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
                                                              MD5:981F351994975A68A0DD3ECE5E889FD0
                                                              SHA1:080D3386290A14A68FCE07709A572AF98097C52D
                                                              SHA-256:3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
                                                              SHA-512:C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a9e78a4f-3f91-4783-b4f0-5edcb54e34d6.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):10505
                                                              Entropy (8bit):5.211196838249082
                                                              Encrypted:false
                                                              SSDEEP:192:st3kdzss+tsZihPykAD+3K8obV+FIjQA66WhlaFIMYAPnYJ:st34ss+tfhP6DnbGEQx6WhlaTYJ
                                                              MD5:A34162D5103C3092F8222DCFF49F1C0C
                                                              SHA1:1CFBFBB50F3ED15F01691BC9386BC5EA854D992B
                                                              SHA-256:2804FCFCA008CE9E39CBC50933B2175A90F7E8102FF8A74BD19510EEC82ADF8D
                                                              SHA-512:635A63616B2DF59D4ACBFCD506D8F89DCC926E45209976E84E06774BB394A3ABC09CF4AB6C1221F1A874B562CF0196558013EA9476C1EDC045167DBE36E9601A
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370067355800565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):11755
                                                              Entropy (8bit):5.190465908239046
                                                              Encrypted:false
                                                              SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                              MD5:07301A857C41B5854E6F84CA00B81EA0
                                                              SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                              SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                              SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                              Malicious:false
                                                              Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c1fcda1d-dc13-4bce-997f-6c186d8ab175.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:L:L
                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                              Malicious:false
                                                              Preview:.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ce1fe219-9a26-4f7b-8c30-1a6ed52d6355.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):26889
                                                              Entropy (8bit):5.576541992236378
                                                              Encrypted:false
                                                              SSDEEP:768:sp3vBvWPdBfYH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNRr4UVrwVWpsbtuL:sp3vBvWPdBfYHu1jaxNR0UeVZbtc
                                                              MD5:4D7206F92CEC5C9CCF8FB9D782BA971C
                                                              SHA1:C4AC32F08B728E07D86E04ABAE0A618D22993D1D
                                                              SHA-256:B3ED08528202E86ADB91CEA0D2FB3C7955F83FE53D1C1C511A9356FE7217ED5A
                                                              SHA-512:11DBF27D202231FD2EDD88E737A2480F2BDD40D5E063B272B6BD75E4222537786D7F1C4FD6E9DF46DFC7AF2AFEE0D961FFC13FDAA86C737D03C8C6231BCFFBB3
                                                              Malicious:false
                                                              Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370067355253838","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370067355253838","location":5,"ma

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):28672
                                                              Entropy (8bit):0.3410017321959524
                                                              Encrypted:false
                                                              SSDEEP:12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
                                                              MD5:98643AF1CA5C0FE03CE8C687189CE56B
                                                              SHA1:ECADBA79A364D72354C658FD6EA3D5CF938F686B
                                                              SHA-256:4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
                                                              SHA-512:68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e78d0af9-7620-4d31-8706-0eac547a3c27.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):30244
                                                              Entropy (8bit):5.566159663863916
                                                              Encrypted:false
                                                              SSDEEP:768:sp3vq97pLGLv6vWPdBf/H8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNRr4UVrwGWpse:sp3vqrcv6vWPdBf/Hu1jaxNR0UeGZbtg
                                                              MD5:17652AEE4A00EABDF0858859A959746B
                                                              SHA1:737DD6124C88EA690AB59D2D14FF494A525F6F9C
                                                              SHA-256:60301D4B05E75A3E953E28787A1849FC8F923184541E9FA4822DE04910FD2F00
                                                              SHA-512:4D02FB2E6B3E06DC4E8C356C51BF42E003C104E866C305A5EAE7313B5E45290CD43DA3AF6B3E52FABE5222A48044A9AA3C1B01283FCE71537A0493502CFAAD4E
                                                              Malicious:false
                                                              Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370067355253838","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370067355253838","location":5,"ma

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f40ec5d8-5cca-4482-81a4-03d3eb8da7bb.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):10505
                                                              Entropy (8bit):5.211346879062766
                                                              Encrypted:false
                                                              SSDEEP:192:st3kdzss+tsZihPykAD+3K8obV+FIjQA66WslaFIMYAPnYJ:st34ss+tfhP6DnbGEQx6WslaTYJ
                                                              MD5:A38325C6EA98598A76ADCD8682137F08
                                                              SHA1:5938F23BE0373C49D49B4C536464503E461E7CF1
                                                              SHA-256:CA8AEBCBEF849A20886271A76211320BB99FDB860C7F3E259F688A291989D260
                                                              SHA-512:DCB9B91577B6307CCB9801C1E8ABA6307E5A908F70C35FCFE325B97B18CB05F35230DCC46AC38B5E986D2201E0BA9A50BB89298D94DE51A9C66C9A3FE6A19A75
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370067355800565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fcdb07b7-8949-4dd7-a71d-a9ac8a9c91f9.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):9749
                                                              Entropy (8bit):5.115450295286968
                                                              Encrypted:false
                                                              SSDEEP:192:st3kdzss+tsZihUkAD+3K8obV+FIjQA66WcaFIMYAPnYJ:st34ss+tfh4DnbGEQx6WcaTYJ
                                                              MD5:621A72041821A499900D3E3B7AB9AFD0
                                                              SHA1:91EFB590A76E3CB7D2684E8876643D3B80B9FCA6
                                                              SHA-256:7F67231AF4C693496B133C6B20A094FE881CFF6E18A5DEE50088827AE0153B79
                                                              SHA-512:EEE6A2737ABD12D54911ED4F150564238FB7CDB53EB95B5B5C98157E353A3A27A4DC0836C35900FB5242DE5770D8906489EC8818655BC218F81A8632A6FEBA7E
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370067355800565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):32768
                                                              Entropy (8bit):0.1156260105406083
                                                              Encrypted:false
                                                              SSDEEP:12:Wt3totCpEjVl/PnnnnnnnnnnnnnnnvoQsUQo8AGS:Wt3t4yoPnnnnnnnnnnnnnnnvN3zd
                                                              MD5:E8AECD1EBC3079F8A3D4F2891FD2B355
                                                              SHA1:EFBC0696EA01307D04EA56E08384233F7188DC78
                                                              SHA-256:913A4CFAFB80C578E3FB1EC332D3D208753B07E83E403B0839A6D64206EBAB4B
                                                              SHA-512:2F81928A87E56BC3E98B9C2557B6772C1E28F7887E92D905A5479BFCDC34EEBE9435C40692D55280604C160964B27D3E38778BD1942C507ABAFB7EFBFD796907
                                                              Malicious:false
                                                              Preview:..-.............].......?..9.K...4..}...t&.LN.O..-.............].......?..9.K...4..}...t&.LN.O........Y...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite Write-Ahead Log, version 3007000
                                                              Category:dropped
                                                              Size (bytes):383192
                                                              Entropy (8bit):1.076546860741563
                                                              Encrypted:false
                                                              SSDEEP:384:G23+kMz/kD//l52GplIZhkyAXzhI710Xdq:p+LkD//l52ilIzkyAXze7uq
                                                              MD5:B49EE44255E543B9817712117BC6BC27
                                                              SHA1:AFB42060D9C653FE6A905D734C30FAE63097FF01
                                                              SHA-256:424E3EBB86293EAB0DFB57B6FA73197A4E1864E5D6DD13FDD99A6A3EB71EA281
                                                              SHA-512:2FFFF862F316600EF2C957CB09AB3E7135D1774F26FA42BBCA9FDB6C7590278E937A1F8EB7CE9EB20886575424951CCB471635733C70B55C8EE16C51BF1EA523
                                                              Malicious:false
                                                              Preview:7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:modified
                                                              Size (bytes):723
                                                              Entropy (8bit):3.210448400244174
                                                              Encrypted:false
                                                              SSDEEP:12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuup4O8w:iDh4
                                                              MD5:89EFAC2DC6F0C3D57EA9D2CCACB56EBC
                                                              SHA1:06BBB4309AB938517DE01BC25D25AD079FB51C66
                                                              SHA-256:0D92474DF08F328BC5602E78FA3F49B0FE50CF20199E6B095582D192F55B2EA6
                                                              SHA-512:2326EF141DEE97921612159785AE427CFC1E732E783D58259988CB8E507A49E02BD21A355DCA73074E08797ECBB389890BDFE939D357B35CB07DFD26248AB9F8
                                                              Malicious:false
                                                              Preview:A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................~.c0................39_config..........6.....n ....1V.e................V.e................V.e................V.e................V.e................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):324
                                                              Entropy (8bit):5.199610823380661
                                                              Encrypted:false
                                                              SSDEEP:6:P5FoojWM+q2P923oH+TcwtfrK+IFUt825FZs1Zmw+25FOkWMVkwO923oH+TcwtfR:PQkL+v4Yeb23FUt82RS/+25LV5LYeb3J
                                                              MD5:0D8ED3A2CDA2F47E6C9F30820665B54B
                                                              SHA1:0262B1A655C238083544E008234B923FA8F969CE
                                                              SHA-256:D41494646915D157459EDA695622942A54B4DD303E988454871834CD88AE731C
                                                              SHA-512:314087193B376BA5A49B6C422A7078D35C6CDA157AFE710BFB60257434475A26AB9AEE4E61C161C64B7370DF6EF21190EFAAA9BC73C198CF488DD94663DEBFB8
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.830 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/09/05-23:35:55.831 1dac Recovering log #3.2024/09/05-23:35:55.832 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):324
                                                              Entropy (8bit):5.199610823380661
                                                              Encrypted:false
                                                              SSDEEP:6:P5FoojWM+q2P923oH+TcwtfrK+IFUt825FZs1Zmw+25FOkWMVkwO923oH+TcwtfR:PQkL+v4Yeb23FUt82RS/+25LV5LYeb3J
                                                              MD5:0D8ED3A2CDA2F47E6C9F30820665B54B
                                                              SHA1:0262B1A655C238083544E008234B923FA8F969CE
                                                              SHA-256:D41494646915D157459EDA695622942A54B4DD303E988454871834CD88AE731C
                                                              SHA-512:314087193B376BA5A49B6C422A7078D35C6CDA157AFE710BFB60257434475A26AB9AEE4E61C161C64B7370DF6EF21190EFAAA9BC73C198CF488DD94663DEBFB8
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.830 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/09/05-23:35:55.831 1dac Recovering log #3.2024/09/05-23:35:55.832 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):787
                                                              Entropy (8bit):4.059252238767438
                                                              Encrypted:false
                                                              SSDEEP:12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
                                                              MD5:D8D8899761F621B63AD5ED6DF46D22FE
                                                              SHA1:23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
                                                              SHA-256:A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
                                                              SHA-512:4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
                                                              Malicious:false
                                                              Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.|.................9_.....'\c..................9_.......f-.................__global... .|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):342
                                                              Entropy (8bit):5.200661625715988
                                                              Encrypted:false
                                                              SSDEEP:6:P5Fvy+WM+q2P923oH+TcwtfrzAdIFUt825FEvz1Zmw+25FEvlWMVkwO923oH+Tc/:P9L+v4Yeb9FUt82cvZ/+2cvlLV5LYebS
                                                              MD5:F3BA2FF63DA7E0F0F1187DA16D899ED4
                                                              SHA1:43511648F19A13770293C07ACDFF43CE83B3011F
                                                              SHA-256:29102B2658989B9C2816F597E1D35B2D7387A6835A78634A05234342D5B912ED
                                                              SHA-512:348604A86B65BBE1DAB1751C4E34306FD469C943FDE701B7CF88BA2FB55DB012E84B69A3F44DD522136FA1E12A46E07F816CF64FE11D66C90EAB8142AFBC1F49
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.825 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/09/05-23:35:55.826 1dac Recovering log #3.2024/09/05-23:35:55.826 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):342
                                                              Entropy (8bit):5.200661625715988
                                                              Encrypted:false
                                                              SSDEEP:6:P5Fvy+WM+q2P923oH+TcwtfrzAdIFUt825FEvz1Zmw+25FEvlWMVkwO923oH+Tc/:P9L+v4Yeb9FUt82cvZ/+2cvlLV5LYebS
                                                              MD5:F3BA2FF63DA7E0F0F1187DA16D899ED4
                                                              SHA1:43511648F19A13770293C07ACDFF43CE83B3011F
                                                              SHA-256:29102B2658989B9C2816F597E1D35B2D7387A6835A78634A05234342D5B912ED
                                                              SHA-512:348604A86B65BBE1DAB1751C4E34306FD469C943FDE701B7CF88BA2FB55DB012E84B69A3F44DD522136FA1E12A46E07F816CF64FE11D66C90EAB8142AFBC1F49
                                                              Malicious:false
                                                              Preview:2024/09/05-23:35:55.825 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/09/05-23:35:55.826 1dac Recovering log #3.2024/09/05-23:35:55.826 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):120
                                                              Entropy (8bit):3.32524464792714
                                                              Encrypted:false
                                                              SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                              MD5:A397E5983D4A1619E36143B4D804B870
                                                              SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                              SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                              SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                              Malicious:false
                                                              Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):13
                                                              Entropy (8bit):2.7192945256669794
                                                              Encrypted:false
                                                              SSDEEP:3:NYLFRQI:ap2I
                                                              MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                              SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                              SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                              SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                              Malicious:false
                                                              Preview:117.0.2045.47

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44137
                                                              Entropy (8bit):6.090722664735474
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Ntbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEq6wtbz8hu3VlXr4CRo1
                                                              MD5:B9ABD347ACC60768F15ADDACB8EFA46A
                                                              SHA1:A397F99B74C9BDB19669A19A06D33F45C26C6427
                                                              SHA-256:7A182400C460FD8CCD975ABB58F53BA714BD3D83C63DF097906D15B77C5ABDA9
                                                              SHA-512:D5EFDF971215BCD1FD4E293BD237BB5432E2CD16A6DE3A98832FF582B54DC3F7F450C69F4D2F3BC961A7BB147AD53E184A471731D7A6163EEEB34E6B0BB24CD1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31137.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44137
                                                              Entropy (8bit):6.090722664735474
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Ntbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEq6wtbz8hu3VlXr4CRo1
                                                              MD5:B9ABD347ACC60768F15ADDACB8EFA46A
                                                              SHA1:A397F99B74C9BDB19669A19A06D33F45C26C6427
                                                              SHA-256:7A182400C460FD8CCD975ABB58F53BA714BD3D83C63DF097906D15B77C5ABDA9
                                                              SHA-512:D5EFDF971215BCD1FD4E293BD237BB5432E2CD16A6DE3A98832FF582B54DC3F7F450C69F4D2F3BC961A7BB147AD53E184A471731D7A6163EEEB34E6B0BB24CD1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31147.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44137
                                                              Entropy (8bit):6.090722664735474
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Ntbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEq6wtbz8hu3VlXr4CRo1
                                                              MD5:B9ABD347ACC60768F15ADDACB8EFA46A
                                                              SHA1:A397F99B74C9BDB19669A19A06D33F45C26C6427
                                                              SHA-256:7A182400C460FD8CCD975ABB58F53BA714BD3D83C63DF097906D15B77C5ABDA9
                                                              SHA-512:D5EFDF971215BCD1FD4E293BD237BB5432E2CD16A6DE3A98832FF582B54DC3F7F450C69F4D2F3BC961A7BB147AD53E184A471731D7A6163EEEB34E6B0BB24CD1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF314f0.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44137
                                                              Entropy (8bit):6.090722664735474
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Ntbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEq6wtbz8hu3VlXr4CRo1
                                                              MD5:B9ABD347ACC60768F15ADDACB8EFA46A
                                                              SHA1:A397F99B74C9BDB19669A19A06D33F45C26C6427
                                                              SHA-256:7A182400C460FD8CCD975ABB58F53BA714BD3D83C63DF097906D15B77C5ABDA9
                                                              SHA-512:D5EFDF971215BCD1FD4E293BD237BB5432E2CD16A6DE3A98832FF582B54DC3F7F450C69F4D2F3BC961A7BB147AD53E184A471731D7A6163EEEB34E6B0BB24CD1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33be1.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44137
                                                              Entropy (8bit):6.090722664735474
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Ntbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEq6wtbz8hu3VlXr4CRo1
                                                              MD5:B9ABD347ACC60768F15ADDACB8EFA46A
                                                              SHA1:A397F99B74C9BDB19669A19A06D33F45C26C6427
                                                              SHA-256:7A182400C460FD8CCD975ABB58F53BA714BD3D83C63DF097906D15B77C5ABDA9
                                                              SHA-512:D5EFDF971215BCD1FD4E293BD237BB5432E2CD16A6DE3A98832FF582B54DC3F7F450C69F4D2F3BC961A7BB147AD53E184A471731D7A6163EEEB34E6B0BB24CD1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42576.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44137
                                                              Entropy (8bit):6.090722664735474
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Ntbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEq6wtbz8hu3VlXr4CRo1
                                                              MD5:B9ABD347ACC60768F15ADDACB8EFA46A
                                                              SHA1:A397F99B74C9BDB19669A19A06D33F45C26C6427
                                                              SHA-256:7A182400C460FD8CCD975ABB58F53BA714BD3D83C63DF097906D15B77C5ABDA9
                                                              SHA-512:D5EFDF971215BCD1FD4E293BD237BB5432E2CD16A6DE3A98832FF582B54DC3F7F450C69F4D2F3BC961A7BB147AD53E184A471731D7A6163EEEB34E6B0BB24CD1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48123.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44137
                                                              Entropy (8bit):6.090722664735474
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Ntbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEq6wtbz8hu3VlXr4CRo1
                                                              MD5:B9ABD347ACC60768F15ADDACB8EFA46A
                                                              SHA1:A397F99B74C9BDB19669A19A06D33F45C26C6427
                                                              SHA-256:7A182400C460FD8CCD975ABB58F53BA714BD3D83C63DF097906D15B77C5ABDA9
                                                              SHA-512:D5EFDF971215BCD1FD4E293BD237BB5432E2CD16A6DE3A98832FF582B54DC3F7F450C69F4D2F3BC961A7BB147AD53E184A471731D7A6163EEEB34E6B0BB24CD1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):0.5963118027796015
                                                              Encrypted:false
                                                              SSDEEP:12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isTydBVzQd9U9ez/qS9i:TLyXOUOq0afDdWec9sJz+Z7J5fc
                                                              MD5:48A6A0713B06707BC2FE9A0F381748D3
                                                              SHA1:043A614CFEF749A49837F19F627B9D6B73F15039
                                                              SHA-256:2F2006ADEA26E5FF95198883A080C9881D774154D073051FC69053AF912B037B
                                                              SHA-512:4C04FFAE2B558EB4C05AD9DCA094700D927AFAD1E561D6358F1A77CB09FC481A6424237DFF6AB37D147E029E19D565E876CD85A2E9C0EC1B068002AA13A16DBA
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):47
                                                              Entropy (8bit):4.3818353308528755
                                                              Encrypted:false
                                                              SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                              MD5:48324111147DECC23AC222A361873FC5
                                                              SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                              SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                              SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                              Malicious:false
                                                              Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):35
                                                              Entropy (8bit):4.014438730983427
                                                              Encrypted:false
                                                              SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                              MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                              SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                              SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                              SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                              Malicious:false
                                                              Preview:{"forceServiceDetermination":false}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):50
                                                              Entropy (8bit):3.9904355005135823
                                                              Encrypted:false
                                                              SSDEEP:3:0xXF/XctY5GUf+:0RFeUf+
                                                              MD5:E144AFBFB9EE10479AE2A9437D3FC9CA
                                                              SHA1:5AAAC173107C688C06944D746394C21535B0514B
                                                              SHA-256:EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
                                                              SHA-512:837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
                                                              Malicious:false
                                                              Preview:topTraffic_170540185939602997400506234197983529371

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):575056
                                                              Entropy (8bit):7.999649474060713
                                                              Encrypted:true
                                                              SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                              MD5:BE5D1A12C1644421F877787F8E76642D
                                                              SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                              SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                              SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                              Malicious:false
                                                              Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):86
                                                              Entropy (8bit):4.3751917412896075
                                                              Encrypted:false
                                                              SSDEEP:3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
                                                              MD5:16B7586B9EBA5296EA04B791FC3D675E
                                                              SHA1:8890767DD7EB4D1BEAB829324BA8B9599051F0B0
                                                              SHA-256:474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
                                                              SHA-512:58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
                                                              Malicious:false
                                                              Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d61d9463-20aa-4a59-92e4-afaa36feb075.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44137
                                                              Entropy (8bit):6.090722664735474
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Ntbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEq6wtbz8hu3VlXr4CRo1
                                                              MD5:B9ABD347ACC60768F15ADDACB8EFA46A
                                                              SHA1:A397F99B74C9BDB19669A19A06D33F45C26C6427
                                                              SHA-256:7A182400C460FD8CCD975ABB58F53BA714BD3D83C63DF097906D15B77C5ABDA9
                                                              SHA-512:D5EFDF971215BCD1FD4E293BD237BB5432E2CD16A6DE3A98832FF582B54DC3F7F450C69F4D2F3BC961A7BB147AD53E184A471731D7A6163EEEB34E6B0BB24CD1
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ed541f37-1733-449d-99a8-9fac6672d901.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):44655
                                                              Entropy (8bit):6.097179002654165
                                                              Encrypted:false
                                                              SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4xkBBwujhDO6vP6OHFT9ZVu/IFFXVcGoup1Xl3jVzXr2:z/Ps+wsI7yOEg6n99Lpchu3VlXr4CRo1
                                                              MD5:153D0F4DC791A2E319D250147513E475
                                                              SHA1:AE6E0139B03B894380CC0E3B45DDA66393E18D01
                                                              SHA-256:CA504AAFA98C24C8B1678D9731265A944B7604AD41B6E2F9AC3EB75781B9FCC3
                                                              SHA-512:FC1BFDB35418D50D6D66B141D6628A2466FD5B19F866C03C944CBA2D690FFB2DA0DD99D30768DFD24E12B795B5A4C3DC4CF6A0251CC9CEB3A7B4934A8D2AF9F2
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                              C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):2278
                                                              Entropy (8bit):3.8489057918805276
                                                              Encrypted:false
                                                              SSDEEP:48:uiTrlKxrgxHxl9Il8uDr9NhGKbJKhE6ShcIVCaPOSd1rc:muYFr9NwKbJKhfSZga2x
                                                              MD5:317C527BC3B2AB0916E591B93BD271F0
                                                              SHA1:521DFAC29280A975BA02324ACD46B0A84CBB1379
                                                              SHA-256:F0D1A672AB251A62C40C4FFB74D13E4638CC89B5EC76A55B8505C10F53BA43DC
                                                              SHA-512:66C24CC644E0A80C9085373B40A70E7CB7358FAC655D2052AC94CD2C37B2DDDBF5813B5790B7A631C4D3651EFB2EE0445034AD549AA959DCB87A85C5E8F6B3EC
                                                              Malicious:false
                                                              Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.G.F.U.R.R.Y.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.7.j.v.z.B.Q.

                                                              C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4622
                                                              Entropy (8bit):3.99419096941318
                                                              Encrypted:false
                                                              SSDEEP:96:CYQlUAJFi8UcNvzWhKpGFWb1SaSbg/JDJY068WQY:C/UAJFgclqhKUFosO/JDWP8m
                                                              MD5:C52677365BD48C431418043571469181
                                                              SHA1:A05634FDF34316F0BA87B587278D9094A063F708
                                                              SHA-256:7192F7F6DCB41F879DC7ECD89901A7AF3EADE2ECEA72C40AA03215677B5F64E5
                                                              SHA-512:F83E3226BFBEFF60B4345B60369727775946022007E76ACE94000CC9D3FAA45C4EAF705E4A4D37916AF48CAF05E35AAF5A984172732544C19FC951A9AA2FBA5F
                                                              Malicious:false
                                                              Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.E.B.F.K.w.4.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.7.j.v.z.B.Q.

                                                              C:\Users\user\AppData\Local\Temp\24ce2fa6-3c11-46d6-8da3-8dc840185df9.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:L:L
                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                              Malicious:false
                                                              Preview:.

                                                              C:\Users\user\AppData\Local\Temp\91321561-c81d-4dda-9d2b-eb09fa32e2f1.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Google Chrome extension, version 3
                                                              Category:dropped
                                                              Size (bytes):11185
                                                              Entropy (8bit):7.951995436832936
                                                              Encrypted:false
                                                              SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                              MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                              SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                              SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                              SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                              Malicious:false
                                                              Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                              C:\Users\user\AppData\Local\Temp\97b09291-db96-4cb9-91e7-e1d2a9efd296.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
                                                              Category:dropped
                                                              Size (bytes):206855
                                                              Entropy (8bit):7.983996634657522
                                                              Encrypted:false
                                                              SSDEEP:3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
                                                              MD5:788DF0376CE061534448AA17288FEA95
                                                              SHA1:C3B9285574587B3D1950EE4A8D64145E93842AEB
                                                              SHA-256:B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
                                                              SHA-512:3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
                                                              Malicious:false
                                                              Preview:......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..*B.P..*(.................*.....................( ..................*.. .".... .".......(.. .".....*.. ....o......E.6... ..*..."........."J......Ah......@.@@....:@{6..wCp..3...((.(......................*...@..(...."....................*......*.. ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

                                                              C:\Users\user\AppData\Local\Temp\9a77b7e8-f89a-49fc-aa18-fa63b99d6da5.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 693862
                                                              Category:dropped
                                                              Size (bytes):524344
                                                              Entropy (8bit):7.998164975885774
                                                              Encrypted:true
                                                              SSDEEP:12288:OjaC1bWOLTpYZBWqYw902J6/f/9mf+x4AsLXZ+E70G+G7:OjaGWqTABEw9L4/nO+x4AsLXZbxd7
                                                              MD5:4AAB3015823B27872242588F3B5BA404
                                                              SHA1:B86547EE3C4B264C8A0B21981D8A5F32E6BA63D6
                                                              SHA-256:49E5552D1599CB93EBC8DB3AF868772A0D8CB9FDB6559B9478B5D4DD46A219BD
                                                              SHA-512:10FE9AF361064DEB8852D559859DAEB6365DBFE9528904C6DA4DD2C143ED1285E90AA180EC72E0687B1D18D26AD952DE8C33BE914C362DDAD1B108690A6957D4
                                                              Malicious:false
                                                              Preview:............o.6.........I....d[.z.6l.=...dIV...q..0...Iyk.C..8.R...v\7.....u..'..r...=.w..W.}..V_....W7......~..........<..f.-.O...l....a.../....l.m.e..kv.Y.n...~......}...ww..uSt.U..o.O...G..4w..|...........]]..y../..W.n...........".y..WB.2*C.7..W.4.....M...I..\&.($...."'....Y.e..o.7y.K.......oZ2.?..qW.O.$.............<.kV`2)G..%,...2.."Q..M.....}g.M`qa.x.Z_....N"......~.~.....;..4.....XEX...B0.Q=.'...z.,.|.>.5..W.6..$\RaT.&.m.%.b.2.....5#[..\...z.j.j|......~RN....@p.C.1.j.}..}..Z..Co'.i.%.TZ...O=%.`.J+............Y|.....mp.6...;v...l?...!..?"Q....a....'.8...)..)7..N...B.8...Yj.?..........V../...g....C..i.....IN...P..P.@.....N..u/...FJ.A<N<..gD. #..6....N.F.....C......4..........?R@.K../-%..P...|.././.o..?#K......%..=.8;........J..............6"..2.........jI....A..W.3......[.....$...>.%iJ..g..A...._....B.>.r...G.5.....$.P[.....J..r.y.4.KE.Lj/)i".w..Ig./.k?.....l../Z.f......"|%.-..T.....).l."Q..j*>%..E.J6...l...^.f.=`%./.l......7$D

                                                              C:\Users\user\AppData\Local\Temp\aa7aadde-9891-4b06-9716-df7f6cc5432e.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Google Chrome extension, version 3
                                                              Category:dropped
                                                              Size (bytes):135751
                                                              Entropy (8bit):7.804610863392373
                                                              Encrypted:false
                                                              SSDEEP:1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
                                                              MD5:83EF25FBEE6866A64F09323BFE1536E0
                                                              SHA1:24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
                                                              SHA-256:F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
                                                              SHA-512:C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
                                                              Malicious:false
                                                              Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7..*.Kk?....]<.S(.....9}........$..6...:...9..b|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]..*..-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

                                                              C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2110
                                                              Entropy (8bit):5.411485941159918
                                                              Encrypted:false
                                                              SSDEEP:48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrW:8e2Fa116uCntc5toYd6vSM
                                                              MD5:A2A282CA5D632C400137B61CBA49A88B
                                                              SHA1:FA821FBDB7F117A1E9CE878BF4DF6282C1776796
                                                              SHA-256:760ED660B32C083CA0DE61C322ECAA7C034B3E695BAB512DBF28BC676C57332A
                                                              SHA-512:E1FAD1AEBE85C3B515CD1D8BDB6144BEB847399A70D0EBCD1799E0A8B676C079F93E8D8DF5C7E1291F8245414F6F7A46D5738549985629F77D7D737A882F544F
                                                              Malicious:false
                                                              Preview:{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

                                                              C:\Users\user\AppData\Local\Temp\d0bbb87a-9e89-48a4-b7cb-e58785f0d0d8.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:L:L
                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                              Malicious:false
                                                              Preview:.

                                                              C:\Users\user\AppData\Local\Temp\dbc8570f-bfcd-48b1-b18f-038d5e071151.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
                                                              Category:dropped
                                                              Size (bytes):76321
                                                              Entropy (8bit):7.996057445951542
                                                              Encrypted:true
                                                              SSDEEP:1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
                                                              MD5:D7A1AC56ED4F4D17DD0524C88892C56D
                                                              SHA1:4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
                                                              SHA-256:0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
                                                              SHA-512:31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
                                                              Malicious:false
                                                              Preview:...........m{..(.}...7.\...N.D*.w..m..q....%XfL.*I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'.*.."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g.*.^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

                                                              C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                              Category:dropped
                                                              Size (bytes):32768
                                                              Entropy (8bit):0.4593089050301797
                                                              Encrypted:false
                                                              SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                              MD5:D910AD167F0217587501FDCDB33CC544
                                                              SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                              SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                              SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                              Malicious:false
                                                              Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_1992927581\91321561-c81d-4dda-9d2b-eb09fa32e2f1.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Google Chrome extension, version 3
                                                              Category:dropped
                                                              Size (bytes):11185
                                                              Entropy (8bit):7.951995436832936
                                                              Encrypted:false
                                                              SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                              MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                              SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                              SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                              SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                              Malicious:false
                                                              Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_1992927581\CRX_INSTALL\_metadata\verified_contents.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1753
                                                              Entropy (8bit):5.8889033066924155
                                                              Encrypted:false
                                                              SSDEEP:48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
                                                              MD5:738E757B92939B24CDBBD0EFC2601315
                                                              SHA1:77058CBAFA625AAFBEA867052136C11AD3332143
                                                              SHA-256:D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
                                                              SHA-512:DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
                                                              Malicious:false
                                                              Preview:[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_1992927581\CRX_INSTALL\content.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
                                                              Category:dropped
                                                              Size (bytes):9815
                                                              Entropy (8bit):6.1716321262973315
                                                              Encrypted:false
                                                              SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
                                                              MD5:3D20584F7F6C8EAC79E17CCA4207FB79
                                                              SHA1:3C16DCC27AE52431C8CDD92FBAAB0341524D3092
                                                              SHA-256:0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
                                                              SHA-512:315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
                                                              Malicious:false
                                                              Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_1992927581\CRX_INSTALL\content_new.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
                                                              Category:dropped
                                                              Size (bytes):10388
                                                              Entropy (8bit):6.174387413738973
                                                              Encrypted:false
                                                              SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
                                                              MD5:3DE1E7D989C232FC1B58F4E32DE15D64
                                                              SHA1:42B152EA7E7F31A964914F344543B8BF14B5F558
                                                              SHA-256:D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
                                                              SHA-512:177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
                                                              Malicious:false
                                                              Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_1992927581\CRX_INSTALL\manifest.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):962
                                                              Entropy (8bit):5.698567446030411
                                                              Encrypted:false
                                                              SSDEEP:24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
                                                              MD5:E805E9E69FD6ECDCA65136957B1FB3BE
                                                              SHA1:2356F60884130C86A45D4B232A26062C7830E622
                                                              SHA-256:5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
                                                              SHA-512:049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
                                                              Malicious:false
                                                              Preview:{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/*" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/*" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\128.png

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                              Category:dropped
                                                              Size (bytes):4982
                                                              Entropy (8bit):7.929761711048726
                                                              Encrypted:false
                                                              SSDEEP:96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
                                                              MD5:913064ADAAA4C4FA2A9D011B66B33183
                                                              SHA1:99EA751AC2597A080706C690612AEEEE43161FC1
                                                              SHA-256:AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
                                                              SHA-512:162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
                                                              Malicious:false
                                                              Preview:.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb*..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...*T.P.B...*Tx...=.Q..wv.w.....|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......|..}./.....e..,.K.1........W.u.v. ...\.o

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\af\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):908
                                                              Entropy (8bit):4.512512697156616
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
                                                              MD5:12403EBCCE3AE8287A9E823C0256D205
                                                              SHA1:C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
                                                              SHA-256:B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
                                                              SHA-512:153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\am\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1285
                                                              Entropy (8bit):4.702209356847184
                                                              Encrypted:false
                                                              SSDEEP:24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
                                                              MD5:9721EBCE89EC51EB2BAEB4159E2E4D8C
                                                              SHA1:58979859B28513608626B563138097DC19236F1F
                                                              SHA-256:3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
                                                              SHA-512:FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ar\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1244
                                                              Entropy (8bit):4.5533961615623735
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
                                                              MD5:3EC93EA8F8422FDA079F8E5B3F386A73
                                                              SHA1:24640131CCFB21D9BC3373C0661DA02D50350C15
                                                              SHA-256:ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
                                                              SHA-512:F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\az\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):977
                                                              Entropy (8bit):4.867640976960053
                                                              Encrypted:false
                                                              SSDEEP:24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
                                                              MD5:9A798FD298008074E59ECC253E2F2933
                                                              SHA1:1E93DA985E880F3D3350FC94F5CCC498EFC8C813
                                                              SHA-256:628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
                                                              SHA-512:9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\be\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3107
                                                              Entropy (8bit):3.535189746470889
                                                              Encrypted:false
                                                              SSDEEP:48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
                                                              MD5:68884DFDA320B85F9FC5244C2DD00568
                                                              SHA1:FD9C01E03320560CBBB91DC3D1917C96D792A549
                                                              SHA-256:DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
                                                              SHA-512:7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\bg\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1389
                                                              Entropy (8bit):4.561317517930672
                                                              Encrypted:false
                                                              SSDEEP:24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
                                                              MD5:2E6423F38E148AC5A5A041B1D5989CC0
                                                              SHA1:88966FFE39510C06CD9F710DFAC8545672FFDCEB
                                                              SHA-256:AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
                                                              SHA-512:891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\bn\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1763
                                                              Entropy (8bit):4.25392954144533
                                                              Encrypted:false
                                                              SSDEEP:24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
                                                              MD5:651375C6AF22E2BCD228347A45E3C2C9
                                                              SHA1:109AC3A912326171D77869854D7300385F6E628C
                                                              SHA-256:1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
                                                              SHA-512:958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ca\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):930
                                                              Entropy (8bit):4.569672473374877
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
                                                              MD5:D177261FFE5F8AB4B3796D26835F8331
                                                              SHA1:4BE708E2FFE0F018AC183003B74353AD646C1657
                                                              SHA-256:D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
                                                              SHA-512:E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\cs\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):913
                                                              Entropy (8bit):4.947221919047
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
                                                              MD5:CCB00C63E4814F7C46B06E4A142F2DE9
                                                              SHA1:860936B2A500CE09498B07A457E0CCA6B69C5C23
                                                              SHA-256:21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
                                                              SHA-512:35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\cy\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):806
                                                              Entropy (8bit):4.815663786215102
                                                              Encrypted:false
                                                              SSDEEP:12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
                                                              MD5:A86407C6F20818972B80B9384ACFBBED
                                                              SHA1:D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
                                                              SHA-256:A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
                                                              SHA-512:D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\da\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):883
                                                              Entropy (8bit):4.5096240460083905
                                                              Encrypted:false
                                                              SSDEEP:24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
                                                              MD5:B922F7FD0E8CCAC31B411FC26542C5BA
                                                              SHA1:2D25E153983E311E44A3A348B7D97AF9AAD21A30
                                                              SHA-256:48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
                                                              SHA-512:AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\de\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1031
                                                              Entropy (8bit):4.621865814402898
                                                              Encrypted:false
                                                              SSDEEP:24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
                                                              MD5:D116453277CC860D196887CEC6432FFE
                                                              SHA1:0AE00288FDE696795CC62FD36EABC507AB6F4EA4
                                                              SHA-256:36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
                                                              SHA-512:C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\el\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1613
                                                              Entropy (8bit):4.618182455684241
                                                              Encrypted:false
                                                              SSDEEP:24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
                                                              MD5:9ABA4337C670C6349BA38FDDC27C2106
                                                              SHA1:1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
                                                              SHA-256:37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
                                                              SHA-512:8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\en\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):851
                                                              Entropy (8bit):4.4858053753176526
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                              MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                              SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                              SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                              SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\en_CA\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):851
                                                              Entropy (8bit):4.4858053753176526
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                              MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                              SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                              SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                              SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\en_GB\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):848
                                                              Entropy (8bit):4.494568170878587
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
                                                              MD5:3734D498FB377CF5E4E2508B8131C0FA
                                                              SHA1:AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
                                                              SHA-256:AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
                                                              SHA-512:56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\en_US\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1425
                                                              Entropy (8bit):4.461560329690825
                                                              Encrypted:false
                                                              SSDEEP:24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
                                                              MD5:578215FBB8C12CB7E6CD73FBD16EC994
                                                              SHA1:9471D71FA6D82CE1863B74E24237AD4FD9477187
                                                              SHA-256:102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
                                                              SHA-512:E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
                                                              Malicious:false
                                                              Preview:{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\es\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):961
                                                              Entropy (8bit):4.537633413451255
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
                                                              MD5:F61916A206AC0E971CDCB63B29E580E3
                                                              SHA1:994B8C985DC1E161655D6E553146FB84D0030619
                                                              SHA-256:2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
                                                              SHA-512:D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\es_419\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):959
                                                              Entropy (8bit):4.570019855018913
                                                              Encrypted:false
                                                              SSDEEP:24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
                                                              MD5:535331F8FB98894877811B14994FEA9D
                                                              SHA1:42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
                                                              SHA-256:90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
                                                              SHA-512:2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\et\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):968
                                                              Entropy (8bit):4.633956349931516
                                                              Encrypted:false
                                                              SSDEEP:24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
                                                              MD5:64204786E7A7C1ED9C241F1C59B81007
                                                              SHA1:586528E87CD670249A44FB9C54B1796E40CDB794
                                                              SHA-256:CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
                                                              SHA-512:44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\eu\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):838
                                                              Entropy (8bit):4.4975520913636595
                                                              Encrypted:false
                                                              SSDEEP:24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
                                                              MD5:29A1DA4ACB4C9D04F080BB101E204E93
                                                              SHA1:2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
                                                              SHA-256:A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
                                                              SHA-512:B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\fa\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1305
                                                              Entropy (8bit):4.673517697192589
                                                              Encrypted:false
                                                              SSDEEP:24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
                                                              MD5:097F3BA8DE41A0AAF436C783DCFE7EF3
                                                              SHA1:986B8CABD794E08C7AD41F0F35C93E4824AC84DF
                                                              SHA-256:7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
                                                              SHA-512:8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\fi\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):911
                                                              Entropy (8bit):4.6294343834070935
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
                                                              MD5:B38CBD6C2C5BFAA6EE252D573A0B12A1
                                                              SHA1:2E490D5A4942D2455C3E751F96BD9960F93C4B60
                                                              SHA-256:2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
                                                              SHA-512:6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\fil\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):939
                                                              Entropy (8bit):4.451724169062555
                                                              Encrypted:false
                                                              SSDEEP:24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
                                                              MD5:FCEA43D62605860FFF41BE26BAD80169
                                                              SHA1:F25C2CE893D65666CC46EA267E3D1AA080A25F5B
                                                              SHA-256:F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
                                                              SHA-512:F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\fr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):977
                                                              Entropy (8bit):4.622066056638277
                                                              Encrypted:false
                                                              SSDEEP:24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
                                                              MD5:A58C0EEBD5DC6BB5D91DAF923BD3A2AA
                                                              SHA1:F169870EEED333363950D0BCD5A46D712231E2AE
                                                              SHA-256:0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
                                                              SHA-512:B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\fr_CA\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):972
                                                              Entropy (8bit):4.621319511196614
                                                              Encrypted:false
                                                              SSDEEP:24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
                                                              MD5:6CAC04BDCC09034981B4AB567B00C296
                                                              SHA1:84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
                                                              SHA-256:4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
                                                              SHA-512:160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\gl\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):990
                                                              Entropy (8bit):4.497202347098541
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
                                                              MD5:6BAAFEE2F718BEFBC7CD58A04CCC6C92
                                                              SHA1:CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
                                                              SHA-256:0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
                                                              SHA-512:3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\gu\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1658
                                                              Entropy (8bit):4.294833932445159
                                                              Encrypted:false
                                                              SSDEEP:24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
                                                              MD5:BC7E1D09028B085B74CB4E04D8A90814
                                                              SHA1:E28B2919F000B41B41209E56B7BF3A4448456CFE
                                                              SHA-256:FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
                                                              SHA-512:040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\hi\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1672
                                                              Entropy (8bit):4.314484457325167
                                                              Encrypted:false
                                                              SSDEEP:48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
                                                              MD5:98A7FC3E2E05AFFFC1CFE4A029F47476
                                                              SHA1:A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
                                                              SHA-256:D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
                                                              SHA-512:457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\hr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):935
                                                              Entropy (8bit):4.6369398601609735
                                                              Encrypted:false
                                                              SSDEEP:24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
                                                              MD5:25CDFF9D60C5FC4740A48EF9804BF5C7
                                                              SHA1:4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
                                                              SHA-256:73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
                                                              SHA-512:EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\hu\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1065
                                                              Entropy (8bit):4.816501737523951
                                                              Encrypted:false
                                                              SSDEEP:24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
                                                              MD5:8930A51E3ACE3DD897C9E61A2AEA1D02
                                                              SHA1:4108506500C68C054BA03310C49FA5B8EE246EA4
                                                              SHA-256:958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
                                                              SHA-512:126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\hy\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2771
                                                              Entropy (8bit):3.7629875118570055
                                                              Encrypted:false
                                                              SSDEEP:48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
                                                              MD5:55DE859AD778E0AA9D950EF505B29DA9
                                                              SHA1:4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
                                                              SHA-256:0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
                                                              SHA-512:EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\id\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):858
                                                              Entropy (8bit):4.474411340525479
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
                                                              MD5:34D6EE258AF9429465AE6A078C2FB1F5
                                                              SHA1:612CAE151984449A4346A66C0A0DF4235D64D932
                                                              SHA-256:E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
                                                              SHA-512:20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\is\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):954
                                                              Entropy (8bit):4.631887382471946
                                                              Encrypted:false
                                                              SSDEEP:12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
                                                              MD5:1F565FB1C549B18AF8BBFED8DECD5D94
                                                              SHA1:B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
                                                              SHA-256:E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
                                                              SHA-512:A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\it\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):899
                                                              Entropy (8bit):4.474743599345443
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
                                                              MD5:0D82B734EF045D5FE7AA680B6A12E711
                                                              SHA1:BD04F181E4EE09F02CD53161DCABCEF902423092
                                                              SHA-256:F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
                                                              SHA-512:01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\iw\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2230
                                                              Entropy (8bit):3.8239097369647634
                                                              Encrypted:false
                                                              SSDEEP:24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
                                                              MD5:26B1533C0852EE4661EC1A27BD87D6BF
                                                              SHA1:18234E3ABAF702DF9330552780C2F33B83A1188A
                                                              SHA-256:BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
                                                              SHA-512:450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ja\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1160
                                                              Entropy (8bit):5.292894989863142
                                                              Encrypted:false
                                                              SSDEEP:24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
                                                              MD5:15EC1963FC113D4AD6E7E59AE5DE7C0A
                                                              SHA1:4017FC6D8B302335469091B91D063B07C9E12109
                                                              SHA-256:34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
                                                              SHA-512:427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ka\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3264
                                                              Entropy (8bit):3.586016059431306
                                                              Encrypted:false
                                                              SSDEEP:48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
                                                              MD5:83F81D30913DC4344573D7A58BD20D85
                                                              SHA1:5AD0E91EA18045232A8F9DF1627007FE506A70E0
                                                              SHA-256:30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
                                                              SHA-512:85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\kk\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3235
                                                              Entropy (8bit):3.6081439490236464
                                                              Encrypted:false
                                                              SSDEEP:96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
                                                              MD5:2D94A58795F7B1E6E43C9656A147AD3C
                                                              SHA1:E377DB505C6924B6BFC9D73DC7C02610062F674E
                                                              SHA-256:548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
                                                              SHA-512:F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\km\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3122
                                                              Entropy (8bit):3.891443295908904
                                                              Encrypted:false
                                                              SSDEEP:96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
                                                              MD5:B3699C20A94776A5C2F90AEF6EB0DAD9
                                                              SHA1:1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
                                                              SHA-256:A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
                                                              SHA-512:1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\kn\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1880
                                                              Entropy (8bit):4.295185867329351
                                                              Encrypted:false
                                                              SSDEEP:48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
                                                              MD5:8E16966E815C3C274EEB8492B1EA6648
                                                              SHA1:7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
                                                              SHA-256:418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
                                                              SHA-512:85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ko\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1042
                                                              Entropy (8bit):5.3945675025513955
                                                              Encrypted:false
                                                              SSDEEP:24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
                                                              MD5:F3E59EEEB007144EA26306C20E04C292
                                                              SHA1:83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
                                                              SHA-256:C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
                                                              SHA-512:7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\lo\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2535
                                                              Entropy (8bit):3.8479764584971368
                                                              Encrypted:false
                                                              SSDEEP:48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
                                                              MD5:E20D6C27840B406555E2F5091B118FC5
                                                              SHA1:0DCECC1A58CEB4936E255A64A2830956BFA6EC14
                                                              SHA-256:89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
                                                              SHA-512:AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\lt\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1028
                                                              Entropy (8bit):4.797571191712988
                                                              Encrypted:false
                                                              SSDEEP:24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
                                                              MD5:970544AB4622701FFDF66DC556847652
                                                              SHA1:14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
                                                              SHA-256:5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
                                                              SHA-512:CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\lv\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):994
                                                              Entropy (8bit):4.700308832360794
                                                              Encrypted:false
                                                              SSDEEP:24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
                                                              MD5:A568A58817375590007D1B8ABCAEBF82
                                                              SHA1:B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
                                                              SHA-256:0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
                                                              SHA-512:FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ml\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2091
                                                              Entropy (8bit):4.358252286391144
                                                              Encrypted:false
                                                              SSDEEP:24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
                                                              MD5:4717EFE4651F94EFF6ACB6653E868D1A
                                                              SHA1:B8A7703152767FBE1819808876D09D9CC1C44450
                                                              SHA-256:22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
                                                              SHA-512:487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\mn\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2778
                                                              Entropy (8bit):3.595196082412897
                                                              Encrypted:false
                                                              SSDEEP:48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
                                                              MD5:83E7A14B7FC60D4C66BF313C8A2BEF0B
                                                              SHA1:1CCF1D79CDED5D65439266DB58480089CC110B18
                                                              SHA-256:613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
                                                              SHA-512:3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\mr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1719
                                                              Entropy (8bit):4.287702203591075
                                                              Encrypted:false
                                                              SSDEEP:48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
                                                              MD5:3B98C4ED8874A160C3789FEAD5553CFA
                                                              SHA1:5550D0EC548335293D962AAA96B6443DD8ABB9F6
                                                              SHA-256:ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
                                                              SHA-512:5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ms\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):936
                                                              Entropy (8bit):4.457879437756106
                                                              Encrypted:false
                                                              SSDEEP:24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
                                                              MD5:7D273824B1E22426C033FF5D8D7162B7
                                                              SHA1:EADBE9DBE5519BD60458B3551BDFC36A10049DD1
                                                              SHA-256:2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
                                                              SHA-512:E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\my\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3830
                                                              Entropy (8bit):3.5483353063347587
                                                              Encrypted:false
                                                              SSDEEP:48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
                                                              MD5:342335A22F1886B8BC92008597326B24
                                                              SHA1:2CB04F892E430DCD7705C02BF0A8619354515513
                                                              SHA-256:243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
                                                              SHA-512:CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ne\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1898
                                                              Entropy (8bit):4.187050294267571
                                                              Encrypted:false
                                                              SSDEEP:24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
                                                              MD5:B1083DA5EC718D1F2F093BD3D1FB4F37
                                                              SHA1:74B6F050D918448396642765DEF1AD5390AB5282
                                                              SHA-256:E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
                                                              SHA-512:7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\nl\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):914
                                                              Entropy (8bit):4.513485418448461
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
                                                              MD5:32DF72F14BE59A9BC9777113A8B21DE6
                                                              SHA1:2A8D9B9A998453144307DD0B700A76E783062AD0
                                                              SHA-256:F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
                                                              SHA-512:E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\no\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):878
                                                              Entropy (8bit):4.4541485835627475
                                                              Encrypted:false
                                                              SSDEEP:24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
                                                              MD5:A1744B0F53CCF889955B95108367F9C8
                                                              SHA1:6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
                                                              SHA-256:21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
                                                              SHA-512:F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\pa\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2766
                                                              Entropy (8bit):3.839730779948262
                                                              Encrypted:false
                                                              SSDEEP:48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
                                                              MD5:97F769F51B83D35C260D1F8CFD7990AF
                                                              SHA1:0D59A76564B0AEE31D0A074305905472F740CECA
                                                              SHA-256:BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
                                                              SHA-512:D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\pl\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):978
                                                              Entropy (8bit):4.879137540019932
                                                              Encrypted:false
                                                              SSDEEP:24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
                                                              MD5:B8D55E4E3B9619784AECA61BA15C9C0F
                                                              SHA1:B4A9C9885FBEB78635957296FDDD12579FEFA033
                                                              SHA-256:E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
                                                              SHA-512:266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\pt_BR\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):907
                                                              Entropy (8bit):4.599411354657937
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
                                                              MD5:608551F7026E6BA8C0CF85D9AC11F8E3
                                                              SHA1:87B017B2D4DA17E322AF6384F82B57B807628617
                                                              SHA-256:A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
                                                              SHA-512:82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\pt_PT\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):914
                                                              Entropy (8bit):4.604761241355716
                                                              Encrypted:false
                                                              SSDEEP:24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
                                                              MD5:0963F2F3641A62A78B02825F6FA3941C
                                                              SHA1:7E6972BEAB3D18E49857079A24FB9336BC4D2D48
                                                              SHA-256:E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
                                                              SHA-512:22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ro\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):937
                                                              Entropy (8bit):4.686555713975264
                                                              Encrypted:false
                                                              SSDEEP:24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
                                                              MD5:BED8332AB788098D276B448EC2B33351
                                                              SHA1:6084124A2B32F386967DA980CBE79DD86742859E
                                                              SHA-256:085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
                                                              SHA-512:22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ru\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1337
                                                              Entropy (8bit):4.69531415794894
                                                              Encrypted:false
                                                              SSDEEP:24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
                                                              MD5:51D34FE303D0C90EE409A2397FCA437D
                                                              SHA1:B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
                                                              SHA-256:BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
                                                              SHA-512:E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\si\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2846
                                                              Entropy (8bit):3.7416822879702547
                                                              Encrypted:false
                                                              SSDEEP:48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
                                                              MD5:B8A4FD612534A171A9A03C1984BB4BDD
                                                              SHA1:F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
                                                              SHA-256:54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
                                                              SHA-512:C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\sk\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):934
                                                              Entropy (8bit):4.882122893545996
                                                              Encrypted:false
                                                              SSDEEP:24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
                                                              MD5:8E55817BF7A87052F11FE554A61C52D5
                                                              SHA1:9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
                                                              SHA-256:903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
                                                              SHA-512:EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\sl\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):963
                                                              Entropy (8bit):4.6041913416245
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
                                                              MD5:BFAEFEFF32813DF91C56B71B79EC2AF4
                                                              SHA1:F8EDA2B632610972B581724D6B2F9782AC37377B
                                                              SHA-256:AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
                                                              SHA-512:971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\sr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1320
                                                              Entropy (8bit):4.569671329405572
                                                              Encrypted:false
                                                              SSDEEP:24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
                                                              MD5:7F5F8933D2D078618496C67526A2B066
                                                              SHA1:B7050E3EFA4D39548577CF47CB119FA0E246B7A4
                                                              SHA-256:4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
                                                              SHA-512:0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\sv\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):884
                                                              Entropy (8bit):4.627108704340797
                                                              Encrypted:false
                                                              SSDEEP:24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
                                                              MD5:90D8FB448CE9C0B9BA3D07FB8DE6D7EE
                                                              SHA1:D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
                                                              SHA-256:64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
                                                              SHA-512:6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\sw\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):980
                                                              Entropy (8bit):4.50673686618174
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
                                                              MD5:D0579209686889E079D87C23817EDDD5
                                                              SHA1:C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
                                                              SHA-256:0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
                                                              SHA-512:D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ta\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1941
                                                              Entropy (8bit):4.132139619026436
                                                              Encrypted:false
                                                              SSDEEP:24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
                                                              MD5:DCC0D1725AEAEAAF1690EF8053529601
                                                              SHA1:BB9D31859469760AC93E84B70B57909DCC02EA65
                                                              SHA-256:6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
                                                              SHA-512:6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\te\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1969
                                                              Entropy (8bit):4.327258153043599
                                                              Encrypted:false
                                                              SSDEEP:48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
                                                              MD5:385E65EF723F1C4018EEE6E4E56BC03F
                                                              SHA1:0CEA195638A403FD99BAEF88A360BD746C21DF42
                                                              SHA-256:026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
                                                              SHA-512:E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\th\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1674
                                                              Entropy (8bit):4.343724179386811
                                                              Encrypted:false
                                                              SSDEEP:48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
                                                              MD5:64077E3D186E585A8BEA86FF415AA19D
                                                              SHA1:73A861AC810DABB4CE63AD052E6E1834F8CA0E65
                                                              SHA-256:D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
                                                              SHA-512:56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\tr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1063
                                                              Entropy (8bit):4.853399816115876
                                                              Encrypted:false
                                                              SSDEEP:24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
                                                              MD5:76B59AAACC7B469792694CF3855D3F4C
                                                              SHA1:7C04A2C1C808FA57057A4CCEEE66855251A3C231
                                                              SHA-256:B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
                                                              SHA-512:2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\uk\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1333
                                                              Entropy (8bit):4.686760246306605
                                                              Encrypted:false
                                                              SSDEEP:24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
                                                              MD5:970963C25C2CEF16BB6F60952E103105
                                                              SHA1:BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
                                                              SHA-256:9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
                                                              SHA-512:1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\ur\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1263
                                                              Entropy (8bit):4.861856182762435
                                                              Encrypted:false
                                                              SSDEEP:24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
                                                              MD5:8B4DF6A9281333341C939C244DDB7648
                                                              SHA1:382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
                                                              SHA-256:5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
                                                              SHA-512:FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\vi\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1074
                                                              Entropy (8bit):5.062722522759407
                                                              Encrypted:false
                                                              SSDEEP:24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
                                                              MD5:773A3B9E708D052D6CBAA6D55C8A5438
                                                              SHA1:5617235844595D5C73961A2C0A4AC66D8EA5F90F
                                                              SHA-256:597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
                                                              SHA-512:E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\zh_CN\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):879
                                                              Entropy (8bit):5.7905809868505544
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
                                                              MD5:3E76788E17E62FB49FB5ED5F4E7A3DCE
                                                              SHA1:6904FFA0D13D45496F126E58C886C35366EFCC11
                                                              SHA-256:E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
                                                              SHA-512:F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\zh_HK\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1205
                                                              Entropy (8bit):4.50367724745418
                                                              Encrypted:false
                                                              SSDEEP:24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
                                                              MD5:524E1B2A370D0E71342D05DDE3D3E774
                                                              SHA1:60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
                                                              SHA-256:30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
                                                              SHA-512:D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\zh_TW\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):843
                                                              Entropy (8bit):5.76581227215314
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
                                                              MD5:0E60627ACFD18F44D4DF469D8DCE6D30
                                                              SHA1:2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
                                                              SHA-256:F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
                                                              SHA-512:6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_locales\zu\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):912
                                                              Entropy (8bit):4.65963951143349
                                                              Encrypted:false
                                                              SSDEEP:24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
                                                              MD5:71F916A64F98B6D1B5D1F62D297FDEC1
                                                              SHA1:9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
                                                              SHA-256:EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
                                                              SHA-512:30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\_metadata\verified_contents.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):11280
                                                              Entropy (8bit):5.754230909218899
                                                              Encrypted:false
                                                              SSDEEP:192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
                                                              MD5:BE5DB35513DDEF454CE3502B6418B9B4
                                                              SHA1:C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
                                                              SHA-256:C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
                                                              SHA-512:38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
                                                              Malicious:false
                                                              Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\dasherSettingSchema.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):854
                                                              Entropy (8bit):4.284628987131403
                                                              Encrypted:false
                                                              SSDEEP:12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
                                                              MD5:4EC1DF2DA46182103D2FFC3B92D20CA5
                                                              SHA1:FB9D1BA3710CF31A87165317C6EDC110E98994CE
                                                              SHA-256:6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
                                                              SHA-512:939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
                                                              Malicious:false
                                                              Preview:{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\manifest.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2525
                                                              Entropy (8bit):5.417689528134667
                                                              Encrypted:false
                                                              SSDEEP:24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
                                                              MD5:10FF8E5B674311683D27CE1879384954
                                                              SHA1:9C269C14E067BB86642EB9F4816D75CF1B9B9158
                                                              SHA-256:17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
                                                              SHA-512:4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
                                                              Malicious:false
                                                              Preview:{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/*", "https://drive.google.com/*", "https://drive-autopush.corp.google.com/*", "https://drive-daily-0.corp.google.com/*", "https://drive-daily-1.corp.google.com/*", "https://drive-daily-2.corp.google.com/*", "https://drive-daily-3.corp.google.com/*", "https://drive-daily-4.corp.google.com/*", "https://drive-daily-5.corp.google.com/*", "https://drive-daily-6.corp.google.com/*", "https://drive-preprod.corp.google.com/*", "https://drive-staging.corp.google.com/*" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\offscreendocument.html

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:HTML document, ASCII text
                                                              Category:dropped
                                                              Size (bytes):97
                                                              Entropy (8bit):4.862433271815736
                                                              Encrypted:false
                                                              SSDEEP:3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
                                                              MD5:B747B5922A0BC74BBF0A9BC59DF7685F
                                                              SHA1:7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
                                                              SHA-256:B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
                                                              SHA-512:7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
                                                              Malicious:false
                                                              Preview:<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\offscreendocument_main.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with very long lines (4369)
                                                              Category:dropped
                                                              Size (bytes):95567
                                                              Entropy (8bit):5.4016395763198135
                                                              Encrypted:false
                                                              SSDEEP:1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
                                                              MD5:09AF2D8CFA8BF1078101DA78D09C4174
                                                              SHA1:F2369551E2CDD86258062BEB0729EE4D93FCA050
                                                              SHA-256:39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
                                                              SHA-512:F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
                                                              Malicious:false
                                                              Preview:'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\page_embed_script.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):291
                                                              Entropy (8bit):4.65176400421739
                                                              Encrypted:false
                                                              SSDEEP:6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
                                                              MD5:3AB0CD0F493B1B185B42AD38AE2DD572
                                                              SHA1:079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
                                                              SHA-256:73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
                                                              SHA-512:32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
                                                              Malicious:false
                                                              Preview:(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\CRX_INSTALL\service_worker_bin_prod.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with very long lines (4369)
                                                              Category:dropped
                                                              Size (bytes):103988
                                                              Entropy (8bit):5.389407461078688
                                                              Encrypted:false
                                                              SSDEEP:1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
                                                              MD5:EA946F110850F17E637B15CF22B82837
                                                              SHA1:8D27C963E76E3D2F5B8634EE66706F95F000FCAF
                                                              SHA-256:029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
                                                              SHA-512:5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
                                                              Malicious:false
                                                              Preview:'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir7336_558705233\aa7aadde-9891-4b06-9716-df7f6cc5432e.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Google Chrome extension, version 3
                                                              Category:dropped
                                                              Size (bytes):135751
                                                              Entropy (8bit):7.804610863392373
                                                              Encrypted:false
                                                              SSDEEP:1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
                                                              MD5:83EF25FBEE6866A64F09323BFE1536E0
                                                              SHA1:24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
                                                              SHA-256:F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
                                                              SHA-512:C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
                                                              Malicious:false
                                                              Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7..*.Kk?....]<.S(.....9}........$..6...:...9..b|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]..*..-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

                                                              C:\Users\user\AppData\Local\Temp\tmpaddon

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                              Category:dropped
                                                              Size (bytes):453023
                                                              Entropy (8bit):7.997718157581587
                                                              Encrypted:true
                                                              SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
                                                              MD5:85430BAED3398695717B0263807CF97C
                                                              SHA1:FFFBEE923CEA216F50FCE5D54219A188A5100F41
                                                              SHA-256:A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
                                                              SHA-512:06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
                                                              Malicious:false
                                                              Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):3.91829583405449
                                                              Encrypted:false
                                                              SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                              MD5:3088F0272D29FAA42ED452C5E8120B08
                                                              SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                              SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                              SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                              Malicious:false
                                                              Preview:{"schema":6,"addons":[]}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):3.91829583405449
                                                              Encrypted:false
                                                              SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                              MD5:3088F0272D29FAA42ED452C5E8120B08
                                                              SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                              SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                              SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                              Malicious:false
                                                              Preview:{"schema":6,"addons":[]}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4 (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                              Category:dropped
                                                              Size (bytes):66
                                                              Entropy (8bit):4.837595020998689
                                                              Encrypted:false
                                                              SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                              MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                              SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                              SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                              SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                              Malicious:false
                                                              Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                              Category:dropped
                                                              Size (bytes):66
                                                              Entropy (8bit):4.837595020998689
                                                              Encrypted:false
                                                              SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                              MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                              SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                              SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                              SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                              Malicious:false
                                                              Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):36830
                                                              Entropy (8bit):5.1867463390487
                                                              Encrypted:false
                                                              SSDEEP:768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
                                                              MD5:98875950B62B398FFE70C0A8D0998017
                                                              SHA1:CFCFFF938402E53D341FE392E25D2E6C557E548F
                                                              SHA-256:1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
                                                              SHA-512:728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
                                                              Malicious:false
                                                              Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):36830
                                                              Entropy (8bit):5.1867463390487
                                                              Encrypted:false
                                                              SSDEEP:768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
                                                              MD5:98875950B62B398FFE70C0A8D0998017
                                                              SHA1:CFCFFF938402E53D341FE392E25D2E6C557E548F
                                                              SHA-256:1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
                                                              SHA-512:728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
                                                              Malicious:false
                                                              Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):1021904
                                                              Entropy (8bit):6.648417932394748
                                                              Encrypted:false
                                                              SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                              MD5:FE3355639648C417E8307C6D051E3E37
                                                              SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                              SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                              SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                              Malicious:false
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                              Joe Sandbox View:
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):1021904
                                                              Entropy (8bit):6.648417932394748
                                                              Encrypted:false
                                                              SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                              MD5:FE3355639648C417E8307C6D051E3E37
                                                              SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                              SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                              SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                              Malicious:false
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                              Joe Sandbox View:
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):116
                                                              Entropy (8bit):4.968220104601006
                                                              Encrypted:false
                                                              SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                              MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                              SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                              SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                              SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                              Malicious:false
                                                              Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):116
                                                              Entropy (8bit):4.968220104601006
                                                              Encrypted:false
                                                              SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                              MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                              SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                              SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                              SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                              Malicious:false
                                                              Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ASCII text, with very long lines (1743), with CRLF line terminators
                                                              Category:modified
                                                              Size (bytes):11225
                                                              Entropy (8bit):5.510799340022936
                                                              Encrypted:false
                                                              SSDEEP:192:2nPOeRnHYbBp6RJ0aX+t6SEXKvnfkHWNBw8rFSl:8PegJU068HEwY0
                                                              MD5:7591BCA2383044E7743B4F0DFA72A1DF
                                                              SHA1:57891215111204004CD970D681143370C13DB08B
                                                              SHA-256:E9101482E726822222B7ABD181EB696A4AE50A285098B919B4060E56E42F700F
                                                              SHA-512:6320B2631DFAF9756428EE47F57EB3F9B855F4355D7D7AF62ED4433F4B778C650B366277698E23E281C01C3420108E298F9EE3B726D4E7EF8F36D9D94D09F581
                                                              Malicious:false
                                                              Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1725600966);..user_pref("app.update.lastUpdateTime.background-update-timer", 1725600966);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..u

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ASCII text, with very long lines (1743), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):11225
                                                              Entropy (8bit):5.510799340022936
                                                              Encrypted:false
                                                              SSDEEP:192:2nPOeRnHYbBp6RJ0aX+t6SEXKvnfkHWNBw8rFSl:8PegJU068HEwY0
                                                              MD5:7591BCA2383044E7743B4F0DFA72A1DF
                                                              SHA1:57891215111204004CD970D681143370C13DB08B
                                                              SHA-256:E9101482E726822222B7ABD181EB696A4AE50A285098B919B4060E56E42F700F
                                                              SHA-512:6320B2631DFAF9756428EE47F57EB3F9B855F4355D7D7AF62ED4433F4B778C650B366277698E23E281C01C3420108E298F9EE3B726D4E7EF8F36D9D94D09F581
                                                              Malicious:false
                                                              Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1725600966);..user_pref("app.update.lastUpdateTime.background-update-timer", 1725600966);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..u

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):53
                                                              Entropy (8bit):4.136624295551173
                                                              Encrypted:false
                                                              SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
                                                              MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
                                                              SHA1:B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
                                                              SHA-256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
                                                              SHA-512:076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
                                                              Malicious:false
                                                              Preview:{"profile-after-change":true,"final-ui-startup":true}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):53
                                                              Entropy (8bit):4.136624295551173
                                                              Encrypted:false
                                                              SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
                                                              MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
                                                              SHA1:B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
                                                              SHA-256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
                                                              SHA-512:076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
                                                              Malicious:false
                                                              Preview:{"profile-after-change":true,"final-ui-startup":true}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Mozilla lz4 compressed data, originally 301 bytes
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):5.479558068321437
                                                              Encrypted:false
                                                              SSDEEP:6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqC5mcfnK3SIgCJ8WktVARLNzdDdCQ:vLz2S+EWDDoWqC5mcPK34Ea0rd9
                                                              MD5:68C9F8BAC19AB7BD8F1A13A7CC227F92
                                                              SHA1:E6A2FEA1ABD71E5C6D35CFC10885869BC8064F6A
                                                              SHA-256:425BBD7AA1201ADF9E8D068098A8ECAB3130EF68478C5D30CC81F976FE4EFF84
                                                              SHA-512:6C37136E91957CD4EF5CD88D63DD0B2DAE56CC1C20A2330440D91CEA750DE21E1944125CD7175C9C031864AFB79DC13FF49884A65AB13CAB1CCFAB0140C72E24
                                                              Malicious:false
                                                              Preview:mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2150633470}d..W..5":1j..........@":{"w...Update":1725600957206,"startTim...#35914,"recentCrashes":0},"global":{},"cookies":[]}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Mozilla lz4 compressed data, originally 301 bytes
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):5.479558068321437
                                                              Encrypted:false
                                                              SSDEEP:6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqC5mcfnK3SIgCJ8WktVARLNzdDdCQ:vLz2S+EWDDoWqC5mcPK34Ea0rd9
                                                              MD5:68C9F8BAC19AB7BD8F1A13A7CC227F92
                                                              SHA1:E6A2FEA1ABD71E5C6D35CFC10885869BC8064F6A
                                                              SHA-256:425BBD7AA1201ADF9E8D068098A8ECAB3130EF68478C5D30CC81F976FE4EFF84
                                                              SHA-512:6C37136E91957CD4EF5CD88D63DD0B2DAE56CC1C20A2330440D91CEA750DE21E1944125CD7175C9C031864AFB79DC13FF49884A65AB13CAB1CCFAB0140C72E24
                                                              Malicious:false
                                                              Preview:mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2150633470}d..W..5":1j..........@":{"w...Update":1725600957206,"startTim...#35914,"recentCrashes":0},"global":{},"cookies":[]}

                                                              Static File Info

                                                              General

                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                              Entropy (8bit):6.579590195520285
                                                              TrID:
                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                              • DOS Executable Generic (2002/1) 0.02%
                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                              File name:file.exe
                                                              File size:917'504 bytes
                                                              MD5:03c318cdb19ab95c6214de1d5bfef1df
                                                              SHA1:758363dc892672552731c4bfe52485a60d933312
                                                              SHA256:5ceb5d0c9157680c45f09c037d1c579824821a9b26593ffef8239b5a0ed7e96a
                                                              SHA512:f8660dbe59d12c6a69325f4053a25f14162cca153559238aeeb02dbfe3e96e91d32f7343e69b273d595f73c96898a18e4ec629a54c4b11b1d5f17c4596e7a4ed
                                                              SSDEEP:12288:CqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTT:CqDEvCTbMWu7rQYlBQcBiT6rprG8avT
                                                              TLSH:CF159E0273D1C062FF9B92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
                                                              File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                                              File Icon

                                                              Icon Hash:aaf3e3e3938382a0

                                                              Static PE Info

                                                              General

                                                              Entrypoint:0x420577
                                                              Entrypoint Section:.text
                                                              Digitally signed:false
                                                              Imagebase:0x400000
                                                              Subsystem:windows gui
                                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                              DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                              Time Stamp:0x66DA7605 [Fri Sep 6 03:24:53 2024 UTC]
                                                              TLS Callbacks:
                                                              CLR (.Net) Version:
                                                              OS Version Major:5
                                                              OS Version Minor:1
                                                              File Version Major:5
                                                              File Version Minor:1
                                                              Subsystem Version Major:5
                                                              Subsystem Version Minor:1
                                                              Import Hash:948cc502fe9226992dce9417f952fce3

                                                              Entrypoint Preview

                                                              Instruction
                                                              call 00007F4A7D0C0E63h
                                                              jmp 00007F4A7D0C076Fh
                                                              push ebp
                                                              mov ebp, esp
                                                              push esi
                                                              push dword ptr [ebp+08h]
                                                              mov esi, ecx
                                                              call 00007F4A7D0C094Dh
                                                              mov dword ptr [esi], 0049FDF0h
                                                              mov eax, esi
                                                              pop esi
                                                              pop ebp
                                                              retn 0004h
                                                              and dword ptr [ecx+04h], 00000000h
                                                              mov eax, ecx
                                                              and dword ptr [ecx+08h], 00000000h
                                                              mov dword ptr [ecx+04h], 0049FDF8h
                                                              mov dword ptr [ecx], 0049FDF0h
                                                              ret
                                                              push ebp
                                                              mov ebp, esp
                                                              push esi
                                                              push dword ptr [ebp+08h]
                                                              mov esi, ecx
                                                              call 00007F4A7D0C091Ah
                                                              mov dword ptr [esi], 0049FE0Ch
                                                              mov eax, esi
                                                              pop esi
                                                              pop ebp
                                                              retn 0004h
                                                              and dword ptr [ecx+04h], 00000000h
                                                              mov eax, ecx
                                                              and dword ptr [ecx+08h], 00000000h
                                                              mov dword ptr [ecx+04h], 0049FE14h
                                                              mov dword ptr [ecx], 0049FE0Ch
                                                              ret
                                                              push ebp
                                                              mov ebp, esp
                                                              push esi
                                                              mov esi, ecx
                                                              lea eax, dword ptr [esi+04h]
                                                              mov dword ptr [esi], 0049FDD0h
                                                              and dword ptr [eax], 00000000h
                                                              and dword ptr [eax+04h], 00000000h
                                                              push eax
                                                              mov eax, dword ptr [ebp+08h]
                                                              add eax, 04h
                                                              push eax
                                                              call 00007F4A7D0C350Dh
                                                              pop ecx
                                                              pop ecx
                                                              mov eax, esi
                                                              pop esi
                                                              pop ebp
                                                              retn 0004h
                                                              lea eax, dword ptr [ecx+04h]
                                                              mov dword ptr [ecx], 0049FDD0h
                                                              push eax
                                                              call 00007F4A7D0C3558h
                                                              pop ecx
                                                              ret
                                                              push ebp
                                                              mov ebp, esp
                                                              push esi
                                                              mov esi, ecx
                                                              lea eax, dword ptr [esi+04h]
                                                              mov dword ptr [esi], 0049FDD0h
                                                              push eax
                                                              call 00007F4A7D0C3541h
                                                              test byte ptr [ebp+08h], 00000001h
                                                              pop ecx

                                                              Rich Headers

                                                              Programming Language:
                                                              • [ C ] VS2008 SP1 build 30729
                                                              • [IMP] VS2008 SP1 build 30729

                                                              Data Directories

                                                              NameVirtual AddressVirtual Size Is in Section
                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000x9500.rsrc
                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0xde0000x7594.reloc
                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                              Sections

                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                              .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                              .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                              .rsrc0xd40000x95000x9600eb6a7bfb75eab94a8823533209ba03ddFalse0.2811197916666667data5.162007987383087IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .reloc0xde0000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                              Resources

                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                              RT_ICON0xd45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                              RT_ICON0xd46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                              RT_ICON0xd47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                              RT_ICON0xd49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                              RT_ICON0xd4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                              RT_ICON0xd4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                              RT_ICON0xd5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                              RT_ICON0xd64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                              RT_ICON0xd69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                              RT_ICON0xd8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                              RT_ICON0xda0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                              RT_MENU0xda4a00x50dataEnglishGreat Britain0.9
                                                              RT_STRING0xda4f00x594dataEnglishGreat Britain0.3333333333333333
                                                              RT_STRING0xdaa840x68adataEnglishGreat Britain0.2735961768219833
                                                              RT_STRING0xdb1100x490dataEnglishGreat Britain0.3715753424657534
                                                              RT_STRING0xdb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                              RT_STRING0xdbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                              RT_STRING0xdc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                              RT_STRING0xdc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                              RT_RCDATA0xdc7b80x7c6data1.0055276381909548
                                                              RT_GROUP_ICON0xdcf800x76dataEnglishGreat Britain0.6610169491525424
                                                              RT_GROUP_ICON0xdcff80x14dataEnglishGreat Britain1.25
                                                              RT_GROUP_ICON0xdd00c0x14dataEnglishGreat Britain1.15
                                                              RT_GROUP_ICON0xdd0200x14dataEnglishGreat Britain1.25
                                                              RT_VERSION0xdd0340xdcdataEnglishGreat Britain0.6181818181818182
                                                              RT_MANIFEST0xdd1100x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                              Imports

                                                              DLLImport
                                                              WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                              VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                              WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                              COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                              MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                              WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                              PSAPI.DLLGetProcessMemoryInfo
                                                              IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                              USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                              UxTheme.dllIsThemeActive
                                                              KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                                                              USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                                                              GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                                                              COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                              ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                                                              SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                              ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                              OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                                                              Possible Origin

                                                              Language of compilation systemCountry where language is spokenMap
                                                              EnglishGreat Britain

                                                              Network Behavior

                                                              Network Port Distribution

                                                              TCP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Sep 6, 2024 05:35:51.557085991 CEST49674443192.168.2.523.1.237.91
                                                              Sep 6, 2024 05:35:51.557089090 CEST49675443192.168.2.523.1.237.91
                                                              Sep 6, 2024 05:35:51.666457891 CEST49673443192.168.2.523.1.237.91
                                                              Sep 6, 2024 05:35:57.605550051 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:57.605576992 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:57.608755112 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:57.608755112 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:57.608784914 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:58.369152069 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:58.373785973 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:58.373795986 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:58.374866962 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:58.374927998 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:58.376661062 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:58.376727104 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:58.377165079 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:58.377171993 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:58.577615023 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:58.600593090 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:58.600657940 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:35:58.600718021 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:58.952898979 CEST49712443192.168.2.594.245.104.56
                                                              Sep 6, 2024 05:35:58.952908993 CEST4434971294.245.104.56192.168.2.5
                                                              Sep 6, 2024 05:36:01.196418047 CEST49675443192.168.2.523.1.237.91
                                                              Sep 6, 2024 05:36:01.276427984 CEST49674443192.168.2.523.1.237.91
                                                              Sep 6, 2024 05:36:01.298543930 CEST49673443192.168.2.523.1.237.91
                                                              Sep 6, 2024 05:36:02.110553980 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.110578060 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.110641003 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.110858917 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.110867977 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.110935926 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.111203909 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.111218929 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.111314058 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.111323118 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.173758030 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.173782110 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.173840046 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.174550056 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.174562931 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.523719072 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:02.523745060 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:02.523888111 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:02.524046898 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:02.524059057 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:02.568763018 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.568994999 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.569009066 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.569999933 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.570058107 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.571161032 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.571221113 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.571690083 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.571702957 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.583165884 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.587465048 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.587471962 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.593700886 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.593790054 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.602575064 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.602673054 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.602817059 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.602829933 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.629570007 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.629968882 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.629976988 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.631016016 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.631074905 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.632215023 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.632272959 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.632476091 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.632486105 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.701426983 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.701481104 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.701668024 CEST49725443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.701683044 CEST44349725162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.720088005 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.720135927 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.720277071 CEST49726443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.720282078 CEST44349726162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.731291056 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.747786999 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.747905016 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.748119116 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.748174906 CEST49727443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:02.748184919 CEST44349727162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:02.935126066 CEST4434970323.1.237.91192.168.2.5
                                                              Sep 6, 2024 05:36:02.935239077 CEST49703443192.168.2.523.1.237.91
                                                              Sep 6, 2024 05:36:03.185127974 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.185156107 CEST44349734162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.185244083 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.185281992 CEST44349735162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.187462091 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.187509060 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.187783957 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.187793970 CEST44349734162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.187841892 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.187849998 CEST44349735162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.255513906 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.286839962 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.286861897 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.287275076 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.287296057 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.287894011 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.294071913 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.294081926 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.295464993 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.295533895 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.295631886 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.295639038 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.382745981 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.520895004 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.520935059 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.521063089 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.521073103 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.524010897 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.526130915 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.526137114 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.530905008 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.537760019 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.537785053 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.538429022 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.538436890 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.540142059 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.545047998 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.551055908 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.551063061 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.551680088 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.553682089 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.553688049 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.558495998 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.565438986 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.565473080 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.571463108 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.571470976 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.584187031 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.607568979 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.610413074 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.610439062 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.612895966 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.612903118 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.616763115 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.617397070 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.624229908 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.624284029 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.629842043 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.629842043 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.629857063 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.631120920 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.638008118 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.638045073 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.644926071 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.645030022 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.645951986 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.645962000 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.651745081 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.652642965 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.654223919 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.654227972 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.658490896 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.659518003 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.659523964 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.661530972 CEST44349735162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.661550045 CEST44349734162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.663225889 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.663239956 CEST44349734162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.663299084 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.663315058 CEST44349735162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.663595915 CEST44349734162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.663682938 CEST44349735162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.664534092 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.664545059 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.664657116 CEST44349735162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.664797068 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.664856911 CEST44349734162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.665457010 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.665462017 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.670171022 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.675725937 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.675757885 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.678786039 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.678795099 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.681386948 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.686960936 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.686989069 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.692604065 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.692635059 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.693973064 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.693983078 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.698200941 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.702868938 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.702876091 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.703855038 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.707729101 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.707813025 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.709110022 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.709117889 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.711409092 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.714873075 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.714901924 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.718415022 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.718442917 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.721936941 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.721968889 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.724147081 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.724158049 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.725712061 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.728960037 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.729039907 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.732501984 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.732527971 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.735831022 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.735837936 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.735868931 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.736277103 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.736361980 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.736366987 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.739749908 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.743058920 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.743156910 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.746756077 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.746788025 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.750094891 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.750175953 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.752509117 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.752516031 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.753787041 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.757303953 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.757332087 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.760864019 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.760947943 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.764235973 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.764262915 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.767503977 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.767515898 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.767759085 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.771122932 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.771203041 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.774470091 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.774998903 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.777785063 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.777822018 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.780992031 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.781028032 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.782500982 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.782516003 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.782674074 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.784169912 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.784200907 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.787301064 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.787427902 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.790596008 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:03.797537088 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.797576904 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.800502062 CEST49733443192.168.2.5142.250.184.225
                                                              Sep 6, 2024 05:36:03.800518990 CEST44349733142.250.184.225192.168.2.5
                                                              Sep 6, 2024 05:36:04.110038042 CEST49739443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:04.110085011 CEST4434973935.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:04.110544920 CEST49739443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:04.117676020 CEST49739443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:04.117691994 CEST4434973935.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:04.241158962 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.241206884 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.241226912 CEST44349735162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.241261959 CEST44349734162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.241432905 CEST44349734162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.241441965 CEST44349735162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.246661901 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.246690035 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.246690035 CEST49734443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.246699095 CEST49735443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.577054977 CEST4434973935.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:04.577244997 CEST49739443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:04.622024059 CEST49739443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:04.622047901 CEST4434973935.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:04.622162104 CEST49739443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:04.622359991 CEST4434973935.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:04.624886036 CEST49739443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:04.682696104 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:04.687490940 CEST804974134.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:04.687994957 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:04.688152075 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:04.692886114 CEST804974134.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:04.790776014 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:04.790796041 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:04.790863037 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:04.792285919 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:04.792304039 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:04.905148983 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:04.905160904 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:04.905453920 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:04.905637980 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:04.905647993 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:04.974587917 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:04.974613905 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:04.975128889 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:04.976912975 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:04.976943970 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:04.977350950 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:04.977363110 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:04.977462053 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:04.977879047 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:04.977891922 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.134179115 CEST804974134.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:05.185883045 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:05.217943907 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.217967033 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.218100071 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.218293905 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.218312025 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.303088903 CEST4974780192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:05.307904005 CEST804974734.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:05.309086084 CEST4974780192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:05.309238911 CEST4974780192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:05.313992023 CEST804974734.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:05.430856943 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.431268930 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.435261965 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.435270071 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.435509920 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.443562031 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.444487095 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.444494009 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.444860935 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.445550919 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.445899010 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.445904970 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.448616982 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.453886032 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.453943014 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.454092979 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.484781981 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.500487089 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.530395985 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.532164097 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:05.532181025 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.532497883 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.533315897 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.533760071 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:05.534804106 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:05.534862995 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.535046101 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:05.546663046 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.548728943 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.548739910 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.549788952 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.549909115 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.552583933 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.552664995 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.552743912 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.576499939 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.587496996 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.587538004 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.587677956 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.587950945 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.588031054 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.590276003 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.590287924 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.590301991 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.590332031 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.592133999 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.595731020 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.595741987 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.596503973 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.598460913 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:05.598468065 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.598516941 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.649656057 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.649666071 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.649697065 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.649707079 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.649722099 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.658150911 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:05.658726931 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.658746004 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.661149979 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:05.664506912 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.675697088 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.675750971 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.675784111 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.675993919 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.676021099 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.676426888 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.677501917 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.677552938 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.677584887 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.677607059 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.677742958 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.688848972 CEST49745443192.168.2.5152.195.19.97
                                                              Sep 6, 2024 05:36:05.688874960 CEST44349745152.195.19.97192.168.2.5
                                                              Sep 6, 2024 05:36:05.697834969 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.697850943 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.702362061 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.702440977 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.708504915 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.708641052 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.723599911 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.724489927 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.736006975 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.736121893 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.736196995 CEST49744443192.168.2.5142.251.41.14
                                                              Sep 6, 2024 05:36:05.736212015 CEST44349744142.251.41.14192.168.2.5
                                                              Sep 6, 2024 05:36:05.738601923 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.744750977 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744760036 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744788885 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744807005 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744817019 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744827032 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744963884 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744972944 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744987965 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744996071 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.744997978 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.745017052 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.751204967 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.752754927 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.752763033 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.752784014 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.774008036 CEST804974734.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:05.806420088 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:05.806447983 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:05.806555986 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:05.806586027 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:05.808027029 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:05.808095932 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:05.809076071 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:05.809087992 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:05.809324980 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:05.809334040 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:05.811022997 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.811041117 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.811050892 CEST49742443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.811058044 CEST44349742184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.828135967 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828144073 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828167915 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828180075 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828187943 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828205109 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828778028 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828787088 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828808069 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828818083 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828825951 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.828850031 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.830686092 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.830694914 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.833185911 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.833200932 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.833216906 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.833228111 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.833247900 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.845459938 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.845469952 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.845478058 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.845504999 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.845514059 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.845520020 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.845526934 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.845534086 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.845556021 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.845583916 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.846307993 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.846348047 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.853822947 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.858640909 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.858653069 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.859659910 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.863857985 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.865933895 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.866022110 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.866080046 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.887818098 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.887844086 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.887902021 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.888202906 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:05.888215065 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:05.908499956 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.915682077 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.915693998 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.915712118 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.915721893 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.915740967 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.915749073 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.916558027 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.916568995 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.916590929 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.916599035 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.916605949 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.916614056 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917213917 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917222023 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917233944 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917253971 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917414904 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.917427063 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917433023 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917450905 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917510986 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917524099 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917562962 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.917573929 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917582035 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917598963 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.917601109 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917608023 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917634964 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.917663097 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.917926073 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917933941 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917963028 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.917970896 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.918750048 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.918766975 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.918790102 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.918797970 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.919785023 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.919791937 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.919815063 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.921330929 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.921339989 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.921371937 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.921408892 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.921452999 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.964948893 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.964973927 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.966556072 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.966571093 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.966595888 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:05.966933012 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:05.984198093 CEST804974734.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:05.984333038 CEST4974780192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:06.001238108 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.001250029 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.001282930 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.001595020 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.001624107 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.001632929 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.002149105 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.002187014 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.002194881 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.014707088 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.014724970 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.014838934 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.014847040 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.014858961 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.014894009 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.014955997 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.015028000 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.015346050 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.025368929 CEST49743443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.025379896 CEST4434974313.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.050709963 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.050719976 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.050751925 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.050760984 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.052932978 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.052942038 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.052959919 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.052968979 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.060529947 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.060543060 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.060697079 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.060882092 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.136991024 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.137015104 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.137051105 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.137058973 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.137084961 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.137170076 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.137181044 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.137213945 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.138066053 CEST49746443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:06.138083935 CEST4434974613.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:06.263900042 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.269970894 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.284877062 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.284892082 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.285307884 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.285990953 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.287601948 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.287616968 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.288001060 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.288502932 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.288507938 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.288511038 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.288718939 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.288765907 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.290854931 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.290925026 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.290936947 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.290997982 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.291270018 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.291558027 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.291563988 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.336513042 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.375999928 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.376022100 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.391222954 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.399178028 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.399271965 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.399383068 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.400777102 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.401523113 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.401557922 CEST49749443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.401577950 CEST44349749142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.402215004 CEST49748443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.402230024 CEST44349748142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.523320913 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:06.523392916 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:06.524996042 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:06.525008917 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:06.525243044 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:06.526726007 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:06.538743973 CEST49752443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.538764000 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.539072037 CEST49753443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.539107084 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.542983055 CEST49753443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.542985916 CEST49752443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.543112040 CEST49753443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.543126106 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.543217897 CEST49752443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.543227911 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.572514057 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:06.705327988 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.705375910 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.705465078 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.705503941 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.705737114 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.705738068 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.706362963 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:06.706370115 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:06.706576109 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.706588984 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.706800938 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.706814051 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.707541943 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:06.707778931 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:06.707782984 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:06.799833059 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:06.799891949 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:06.806991100 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:06.808171034 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:06.808193922 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:06.808203936 CEST49750443192.168.2.5184.28.90.27
                                                              Sep 6, 2024 05:36:06.808209896 CEST44349750184.28.90.27192.168.2.5
                                                              Sep 6, 2024 05:36:06.994457960 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.994859934 CEST49752443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.994874954 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.995193958 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.996014118 CEST49752443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.996076107 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.996901035 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.997176886 CEST49753443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.997190952 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.997503996 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.997817039 CEST49753443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.997874975 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:07.076673031 CEST49752443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:07.119784117 CEST49753443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:07.167793036 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.168025017 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.168040037 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.168790102 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.168848038 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.169612885 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.169681072 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.169878006 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.169939995 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.178548098 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.192600012 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:07.192609072 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.193312883 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.193486929 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.193501949 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.193841934 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.193897009 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.193974972 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.194113970 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:07.194509983 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.194977999 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:07.195040941 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.195147038 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:07.195219994 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.195373058 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.195429087 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.236501932 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.250808954 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:07.250812054 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.250818014 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.250824928 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.276787996 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.276797056 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.290848017 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.290880919 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.290908098 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.290954113 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.291007996 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.291052103 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:07.291902065 CEST49756443192.168.2.5142.251.32.100
                                                              Sep 6, 2024 05:36:07.291913033 CEST44349756142.251.32.100192.168.2.5
                                                              Sep 6, 2024 05:36:07.377078056 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.392721891 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.394702911 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:07.394742012 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:07.394897938 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:07.395140886 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:07.395157099 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.050050020 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.050323009 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.050340891 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.050630093 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.050993919 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.051053047 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.051152945 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.096502066 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.155128002 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.155145884 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.155206919 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.155219078 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.155227900 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.155275106 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.242687941 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.242696047 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.242719889 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.242727041 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.242754936 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.242790937 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.242796898 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.242995977 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.244383097 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.244390965 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.244421959 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.244450092 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.244457960 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.244560003 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.330612898 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.330630064 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.330701113 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.330725908 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.330845118 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.331825972 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.331840038 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.331882954 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.331890106 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.331927061 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:08.331960917 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.331989050 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.332329035 CEST49759443192.168.2.513.107.246.40
                                                              Sep 6, 2024 05:36:08.332344055 CEST4434975913.107.246.40192.168.2.5
                                                              Sep 6, 2024 05:36:11.763314962 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:11.763353109 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:11.763531923 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:11.764471054 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:11.764486074 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:12.828210115 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:12.828305960 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:12.830003023 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:12.830013990 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:12.830239058 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:12.891271114 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:13.565517902 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:13.612503052 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.800523043 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.800543070 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.800549984 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.800581932 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.800597906 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.800607920 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.800614119 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:13.800626993 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.800652981 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:13.800664902 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:13.805344105 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.805411100 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:13.805437088 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:13.805483103 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:14.461271048 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:14.461302996 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:14.461317062 CEST49760443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:14.461322069 CEST4434976013.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:15.143471956 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:15.148315907 CEST804974134.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:15.798614025 CEST4974780192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:15.803433895 CEST804974734.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:21.904925108 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:21.904989004 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:21.905215979 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:21.905282974 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:21.906475067 CEST49752443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:21.906757116 CEST49753443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:25.161668062 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:25.166724920 CEST804974134.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:25.832432985 CEST4974780192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:25.840374947 CEST804974734.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:30.082540989 CEST49766443192.168.2.534.149.100.209
                                                              Sep 6, 2024 05:36:30.082586050 CEST4434976634.149.100.209192.168.2.5
                                                              Sep 6, 2024 05:36:30.082880974 CEST49766443192.168.2.534.149.100.209
                                                              Sep 6, 2024 05:36:30.083058119 CEST49766443192.168.2.534.149.100.209
                                                              Sep 6, 2024 05:36:30.083070040 CEST4434976634.149.100.209192.168.2.5
                                                              Sep 6, 2024 05:36:30.094537973 CEST49767443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:30.094558954 CEST4434976735.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:30.094830036 CEST49767443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:30.096529007 CEST49767443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:30.096539974 CEST4434976735.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:30.109477997 CEST49768443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:30.109497070 CEST4434976835.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:30.109576941 CEST49768443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:30.109707117 CEST49768443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:30.109716892 CEST4434976835.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:30.345505953 CEST49769443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:30.345546961 CEST4434976952.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:30.345957994 CEST49769443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:30.346163034 CEST49769443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:30.346174955 CEST4434976952.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:30.539623976 CEST4434976634.149.100.209192.168.2.5
                                                              Sep 6, 2024 05:36:30.539804935 CEST49766443192.168.2.534.149.100.209
                                                              Sep 6, 2024 05:36:30.542640924 CEST49766443192.168.2.534.149.100.209
                                                              Sep 6, 2024 05:36:30.542649031 CEST4434976634.149.100.209192.168.2.5
                                                              Sep 6, 2024 05:36:30.542865992 CEST4434976634.149.100.209192.168.2.5
                                                              Sep 6, 2024 05:36:30.544838905 CEST49766443192.168.2.534.149.100.209
                                                              Sep 6, 2024 05:36:30.544965029 CEST4434976634.149.100.209192.168.2.5
                                                              Sep 6, 2024 05:36:30.544965029 CEST49766443192.168.2.534.149.100.209
                                                              Sep 6, 2024 05:36:30.544974089 CEST4434976634.149.100.209192.168.2.5
                                                              Sep 6, 2024 05:36:30.545494080 CEST49766443192.168.2.534.149.100.209
                                                              Sep 6, 2024 05:36:30.548145056 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:30.552930117 CEST804974134.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:30.564043999 CEST4434976735.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:30.564209938 CEST49767443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:30.567986965 CEST49767443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:30.567994118 CEST4434976735.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:30.568087101 CEST49767443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:30.568137884 CEST4434976735.190.72.216192.168.2.5
                                                              Sep 6, 2024 05:36:30.568243980 CEST4434976835.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:30.568244934 CEST49767443192.168.2.535.190.72.216
                                                              Sep 6, 2024 05:36:30.568555117 CEST49768443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:30.571784019 CEST49768443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:30.571794033 CEST4434976835.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:30.572127104 CEST4434976835.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:30.573659897 CEST49768443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:30.573769093 CEST49768443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:30.573894024 CEST4434976835.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:30.574678898 CEST4974780192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:30.575267076 CEST49768443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:30.579534054 CEST804974734.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:30.579590082 CEST4974780192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:30.644820929 CEST804974134.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:30.647528887 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:30.652626038 CEST804974134.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:30.654342890 CEST4974180192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:30.658351898 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:30.663197994 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:30.668792009 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:30.669208050 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:30.673944950 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:31.073498964 CEST4434976952.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:31.073693991 CEST49769443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:31.076986074 CEST49769443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:31.076997042 CEST4434976952.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:31.077224970 CEST4434976952.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:31.079303026 CEST49769443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:31.079435110 CEST4434976952.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:31.079477072 CEST49769443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:31.079483032 CEST4434976952.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:31.079588890 CEST49769443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:31.080178976 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:31.080204010 CEST4434977152.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:31.080315113 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:31.080420017 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:31.080430031 CEST4434977152.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:31.116023064 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:31.164134979 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:32.022697926 CEST4434977152.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:32.025414944 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:32.028625011 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:32.028637886 CEST4434977152.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:32.028858900 CEST4434977152.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:32.030795097 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:32.030958891 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:32.030971050 CEST4434977152.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:32.036501884 CEST4434977152.222.236.48192.168.2.5
                                                              Sep 6, 2024 05:36:32.046087980 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:32.046355963 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:32.046355963 CEST49771443192.168.2.552.222.236.48
                                                              Sep 6, 2024 05:36:32.049277067 CEST49772443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.049307108 CEST4434977235.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.051058054 CEST49772443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.051156998 CEST49772443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.051167011 CEST4434977235.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.051907063 CEST49773443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.051949024 CEST4434977335.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.054318905 CEST49773443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.054430008 CEST49773443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.054439068 CEST4434977335.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.056278944 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:32.061081886 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.061304092 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:32.061419010 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:32.062140942 CEST49775443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.062155008 CEST4434977535.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.062273979 CEST49775443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.062336922 CEST49775443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.062341928 CEST4434977535.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.066286087 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.508882046 CEST4434977235.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.509071112 CEST49772443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.511467934 CEST49772443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.511473894 CEST4434977235.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.511688948 CEST4434977235.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.513106108 CEST49772443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.513210058 CEST49772443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.513246059 CEST4434977235.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.514205933 CEST49772443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.517682076 CEST4434977335.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.517843008 CEST49773443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.520536900 CEST49773443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.520543098 CEST4434977335.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.520751953 CEST4434977335.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.522243023 CEST49773443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.522317886 CEST49773443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.524913073 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.527594090 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:32.532335043 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.544795036 CEST4434977535.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.544904947 CEST49775443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.547275066 CEST49775443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.547280073 CEST4434977535.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.547498941 CEST4434977535.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.548957109 CEST49775443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.549031973 CEST49775443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.549082994 CEST4434977535.244.181.201192.168.2.5
                                                              Sep 6, 2024 05:36:32.549249887 CEST49775443192.168.2.535.244.181.201
                                                              Sep 6, 2024 05:36:32.551090956 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:32.557621002 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.621483088 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.651340961 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.655339956 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:32.660510063 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.705235958 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:32.749960899 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:32.801379919 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:42.659579039 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:42.664534092 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:42.759885073 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:42.764671087 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:51.022902966 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.022953033 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.026463032 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.026853085 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.026874065 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.690550089 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.690618992 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.693893909 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.693903923 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.694106102 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.703305006 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.744501114 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.948121071 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.948142052 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.948157072 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.948218107 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.948230028 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.948781013 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.948822975 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.949184895 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.950253010 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.950285912 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.952094078 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.952106953 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:51.952119112 CEST49777443192.168.2.513.85.23.86
                                                              Sep 6, 2024 05:36:51.952122927 CEST4434977713.85.23.86192.168.2.5
                                                              Sep 6, 2024 05:36:52.262381077 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:52.262407064 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:52.292829990 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:52.292841911 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:52.679228067 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:52.684225082 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:52.770781040 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:36:52.775861025 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:36:57.195663929 CEST49752443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:57.195664883 CEST49753443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:57.195693970 CEST44349752162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:57.195693970 CEST44349753162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:59.042016983 CEST49779443192.168.2.523.219.161.132
                                                              Sep 6, 2024 05:36:59.042052984 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:36:59.042129993 CEST49779443192.168.2.523.219.161.132
                                                              Sep 6, 2024 05:36:59.042365074 CEST49779443192.168.2.523.219.161.132
                                                              Sep 6, 2024 05:36:59.042380095 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:36:59.518254995 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:36:59.521075964 CEST49779443192.168.2.523.219.161.132
                                                              Sep 6, 2024 05:36:59.521102905 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:36:59.521425962 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:36:59.522731066 CEST49779443192.168.2.523.219.161.132
                                                              Sep 6, 2024 05:36:59.522793055 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:36:59.522890091 CEST49779443192.168.2.523.219.161.132
                                                              Sep 6, 2024 05:36:59.568502903 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:37:02.690794945 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:02.695561886 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:02.794581890 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:02.799480915 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:03.041155100 CEST49780443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.041212082 CEST4434978034.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.051531076 CEST49780443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.057616949 CEST49780443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.057631016 CEST4434978034.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.104397058 CEST49781443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.104430914 CEST4434978134.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.104583979 CEST49781443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.104723930 CEST49781443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.104732990 CEST4434978134.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.516901970 CEST4434978034.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.516915083 CEST4434978034.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.517347097 CEST49780443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.522128105 CEST49780443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.522131920 CEST4434978034.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.522341013 CEST4434978034.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.525044918 CEST49780443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.525125980 CEST49780443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.525183916 CEST4434978034.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.525223017 CEST49780443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.559425116 CEST4434978134.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.559494972 CEST49781443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.562378883 CEST49781443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.562386990 CEST4434978134.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.562607050 CEST4434978134.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.565080881 CEST49781443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.565172911 CEST49781443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.565222025 CEST4434978134.120.208.123192.168.2.5
                                                              Sep 6, 2024 05:37:03.565279961 CEST49781443192.168.2.534.120.208.123
                                                              Sep 6, 2024 05:37:03.581530094 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:03.586391926 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:03.680114031 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:03.724577904 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:03.919430971 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:03.924290895 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:04.013940096 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:04.054543972 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:13.687086105 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:13.691869974 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:14.025645018 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:14.030664921 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:23.700634003 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:23.705506086 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:24.043473959 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:24.048680067 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:32.694073915 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:37:32.694089890 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:37:32.694145918 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:37:32.694422960 CEST49779443192.168.2.523.219.161.132
                                                              Sep 6, 2024 05:37:32.694700956 CEST49779443192.168.2.523.219.161.132
                                                              Sep 6, 2024 05:37:32.694721937 CEST4434977923.219.161.132192.168.2.5
                                                              Sep 6, 2024 05:37:33.717307091 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:33.722162962 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:34.053359032 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:34.058245897 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:37.263165951 CEST49754443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:37:37.263185024 CEST44349754142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:37:37.300822973 CEST49755443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:37:37.300837994 CEST44349755142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:37:43.723176956 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:43.728065014 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:44.068392038 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:44.073270082 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:53.747258902 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:53.752219915 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:37:54.079430103 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:37:54.084306955 CEST804977034.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:38:03.764535904 CEST4977480192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:38:03.769505024 CEST804977434.107.221.82192.168.2.5
                                                              Sep 6, 2024 05:38:04.096659899 CEST4977080192.168.2.534.107.221.82
                                                              Sep 6, 2024 05:38:04.101597071 CEST804977034.107.221.82192.168.2.5

                                                              UDP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Sep 6, 2024 05:35:57.573981047 CEST53503731.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:35:58.310473919 CEST5157553192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:35:58.310698986 CEST5317253192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:00.438842058 CEST53537921.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:00.572387934 CEST53647631.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.102068901 CEST6484253192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:02.102319956 CEST6365753192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:02.102638960 CEST6304453192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:02.102790117 CEST6154653192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:02.108889103 CEST53648421.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.109185934 CEST53630441.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.109232903 CEST53636571.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.109641075 CEST53615461.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.155483961 CEST5534253192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:02.155968904 CEST5970453192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:02.162035942 CEST53553421.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.162539005 CEST53597041.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.516092062 CEST5341053192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:02.516364098 CEST5623553192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:02.522696972 CEST53534101.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.523200989 CEST53562351.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:02.884351969 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.184794903 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.356877089 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.356956005 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.357321978 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.357338905 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.357348919 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.357855082 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.359137058 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.359420061 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.359525919 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.359805107 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.359910965 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.456718922 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.456733942 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.456743002 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.456752062 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.457773924 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.458703995 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.458837986 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.459507942 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.459603071 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.459992886 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:03.555210114 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:03.586035967 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.118168116 CEST6203053192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:04.127366066 CEST53620301.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:04.128551960 CEST6122253192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:04.135791063 CEST53612221.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:04.209666014 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.209784985 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.241349936 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.241400957 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.241455078 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.241477013 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.242640018 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.244391918 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.244534969 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.244599104 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.307389975 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.309257984 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.309638977 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.329199076 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.337686062 CEST44360445162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.369278908 CEST60445443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.369570971 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.369653940 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.370100021 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.370296955 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.414829969 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.414932013 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.420386076 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.420790911 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.674340010 CEST6335353192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:04.683051109 CEST5657653192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:04.688618898 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.689889908 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.690897942 CEST53565761.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:04.691056967 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.694044113 CEST5171753192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:04.695950985 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.700525999 CEST53517171.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:04.725527048 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.783003092 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.783037901 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.783049107 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.783096075 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.783246040 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.783401012 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.783482075 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.783550024 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.789235115 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.789750099 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.789912939 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.799133062 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.876478910 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.877048016 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.883713961 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.885219097 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.893516064 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.893716097 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.904455900 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.930614948 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.972740889 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.973807096 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.974107981 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.974131107 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.974231005 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.974255085 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.974503994 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.975498915 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:04.989212990 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.989759922 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.991137028 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.991168022 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.991179943 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:04.991188049 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:05.000403881 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.000530958 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.000619888 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.003417015 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.004967928 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.005201101 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.290126085 CEST5399453192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:05.294406891 CEST5556253192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:05.295037985 CEST6284853192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:05.296684027 CEST53539941.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:05.301093102 CEST53555621.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:05.456594944 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.456962109 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.456973076 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.456984043 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.457000017 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.458041906 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.458630085 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.458853960 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.563455105 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.563466072 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.563477993 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.563972950 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.564018011 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.564117908 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.600447893 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.600460052 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.600467920 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.608808041 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.608889103 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.611568928 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.613388062 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.629199028 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.688618898 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.707950115 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.708225012 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.744249105 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.778377056 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.784014940 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.802058935 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:05.803318977 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:05.803522110 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:05.805583954 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.807291985 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:05.807629108 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.807913065 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.901644945 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:05.902147055 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:05.902297020 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:05.902808905 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:05.903654099 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:05.904633999 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:05.904886007 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:05.904900074 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:05.912636995 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:05.913216114 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:06.043005943 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:06.345889091 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.351974964 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.351994038 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.352005959 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.354949951 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.355458021 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.355472088 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.404680014 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.449342012 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.449366093 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.449542999 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.449651003 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.449877977 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.450464964 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.450520992 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.450531006 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.453138113 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.453202009 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.468774080 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.468838930 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.468977928 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:06.538013935 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.562391996 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.563584089 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.563605070 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.564311981 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.598483086 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:06.599705935 CEST61303443192.168.2.5142.251.40.227
                                                              Sep 6, 2024 05:36:06.600640059 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:06.600713968 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:06.600724936 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:06.603176117 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:06.603236914 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:06.604218960 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:06.608714104 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.608824968 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.683321953 CEST44361303142.251.40.227192.168.2.5
                                                              Sep 6, 2024 05:36:06.702862024 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.704724073 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.704905033 CEST44354334162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.705035925 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.705948114 CEST54334443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.708230019 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:06.839755058 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.845386028 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.845400095 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.848654032 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.851504087 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.851516008 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.851527929 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.851541042 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.851706982 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.852549076 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.853409052 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.853538990 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.853874922 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.853893042 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.870260954 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.947447062 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.947460890 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.947882891 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.948120117 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.962647915 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.963211060 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.963973999 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.978195906 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.978513002 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:06.978630066 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:06.986293077 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.986320019 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.986427069 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.986486912 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.986504078 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:06.987112045 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.988734961 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.988828897 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.989006042 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:06.989080906 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:07.004195929 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:07.071531057 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:07.088979959 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:07.089011908 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:07.089020967 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:07.089029074 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:07.089308023 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:07.089509964 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:07.089930058 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:07.090636969 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:07.090795994 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:07.126982927 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:07.188855886 CEST44358994162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:07.223418951 CEST58994443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:07.256191969 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:07.272006989 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:07.272062063 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:07.272072077 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:07.272243023 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:07.273408890 CEST49484443192.168.2.5172.253.63.84
                                                              Sep 6, 2024 05:36:07.402492046 CEST44349484172.253.63.84192.168.2.5
                                                              Sep 6, 2024 05:36:14.128989935 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:14.129045010 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:14.223112106 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:14.257554054 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:14.269819021 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:14.270226955 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:14.270356894 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:14.310842037 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:14.388458967 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:30.074681997 CEST5394953192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:30.081548929 CEST53539491.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:30.082637072 CEST5746053192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:30.089304924 CEST53574601.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:30.091578960 CEST5149853192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:30.104574919 CEST53514981.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:30.109931946 CEST6054553192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:30.116954088 CEST53605451.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:30.119380951 CEST6113653192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:30.126225948 CEST53611361.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:30.150700092 CEST5871753192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:30.158060074 CEST53587171.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:30.346314907 CEST6331953192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:30.353666067 CEST53633191.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:30.354146004 CEST5683353192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:30.361249924 CEST53568331.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:36:30.650868893 CEST5648153192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:36:36.482767105 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:36.591464043 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:36.591849089 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:36.592487097 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:36.626940966 CEST61633443192.168.2.5142.250.176.206
                                                              Sep 6, 2024 05:36:36.712146997 CEST44361633142.250.176.206192.168.2.5
                                                              Sep 6, 2024 05:36:58.311589003 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:58.311647892 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:58.311781883 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:58.311853886 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:58.755709887 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:58.756468058 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:58.757018089 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:58.794682026 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:58.850760937 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:58.850796938 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:58.850804090 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:58.850812912 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:58.851138115 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:58.851303101 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:58.944519043 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:58.944756031 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:36:59.039808989 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:59.041011095 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:59.041460991 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:36:59.041635990 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:37:01.673686981 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:37:01.673804045 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:37:01.770358086 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:37:01.770632982 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:37:01.771300077 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:37:01.771456003 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:37:01.772586107 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:02.073604107 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:02.227229118 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.228944063 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.228981018 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.229015112 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.229049921 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.229486942 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:02.231236935 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:02.231339931 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:02.330101013 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.330111027 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.330116034 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.330118895 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:02.330497026 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:02.330595970 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:02.442693949 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:03.047648907 CEST6362253192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:37:03.054223061 CEST53636221.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:37:03.058871031 CEST5188553192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:37:03.065743923 CEST53518851.1.1.1192.168.2.5
                                                              Sep 6, 2024 05:37:03.581612110 CEST5698953192.168.2.51.1.1.1
                                                              Sep 6, 2024 05:37:06.516083002 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:37:06.516191959 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:37:06.610539913 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:37:06.611237049 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:37:06.611391068 CEST44354239162.159.61.3192.168.2.5
                                                              Sep 6, 2024 05:37:06.611522913 CEST54239443192.168.2.5162.159.61.3
                                                              Sep 6, 2024 05:37:06.612545967 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:06.612665892 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.100111008 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.100132942 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.100621939 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.100632906 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.100697041 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.112941027 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.137957096 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.141287088 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.200201035 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.231810093 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.241065025 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.278604031 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.299633980 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.299644947 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.299652100 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:07.300121069 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.300189972 CEST52378443192.168.2.5142.251.167.84
                                                              Sep 6, 2024 05:37:07.426728010 CEST44352378142.251.167.84192.168.2.5
                                                              Sep 6, 2024 05:37:22.330214977 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:22.362972975 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:22.835557938 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:37:22.867350101 CEST64599443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:37:32.372035027 CEST4436459923.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:38:01.727118015 CEST50262443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:38:02.191659927 CEST4435026223.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:38:02.191688061 CEST4435026223.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:38:02.192528009 CEST50262443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:38:02.288144112 CEST4435026223.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:38:02.288167000 CEST4435026223.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:38:02.288177967 CEST4435026223.43.85.27192.168.2.5
                                                              Sep 6, 2024 05:38:02.288568974 CEST50262443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:38:02.323921919 CEST50262443192.168.2.523.43.85.27
                                                              Sep 6, 2024 05:38:02.393779993 CEST4435026223.43.85.27192.168.2.5

                                                              DNS Queries

                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                              Sep 6, 2024 05:35:58.310473919 CEST192.168.2.51.1.1.10xe31fStandard query (0)bzib.nelreports.netA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:35:58.310698986 CEST192.168.2.51.1.1.10x1fa6Standard query (0)bzib.nelreports.net65IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.102068901 CEST192.168.2.51.1.1.10x9d1aStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.102319956 CEST192.168.2.51.1.1.10xde11Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.102638960 CEST192.168.2.51.1.1.10xca41Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.102790117 CEST192.168.2.51.1.1.10x6deeStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.155483961 CEST192.168.2.51.1.1.10xaaaaStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.155968904 CEST192.168.2.51.1.1.10x19ffStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.516092062 CEST192.168.2.51.1.1.10xf23fStandard query (0)clients2.googleusercontent.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.516364098 CEST192.168.2.51.1.1.10x9045Standard query (0)clients2.googleusercontent.com65IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.118168116 CEST192.168.2.51.1.1.10x5c2dStandard query (0)prod.classify-client.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.128551960 CEST192.168.2.51.1.1.10x4fe1Standard query (0)prod.classify-client.prod.webservices.mozgcp.net28IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.674340010 CEST192.168.2.51.1.1.10xf770Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.683051109 CEST192.168.2.51.1.1.10xe42eStandard query (0)prod.detectportal.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.694044113 CEST192.168.2.51.1.1.10x2560Standard query (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                              Sep 6, 2024 05:36:05.290126085 CEST192.168.2.51.1.1.10xe719Standard query (0)example.orgA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:05.294406891 CEST192.168.2.51.1.1.10x94feStandard query (0)ipv4only.arpaA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:05.295037985 CEST192.168.2.51.1.1.10x634aStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.074681997 CEST192.168.2.51.1.1.10x7f57Standard query (0)firefox.settings.services.mozilla.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.082637072 CEST192.168.2.51.1.1.10xdbe3Standard query (0)prod.remote-settings.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.091578960 CEST192.168.2.51.1.1.10xc911Standard query (0)prod.remote-settings.prod.webservices.mozgcp.net28IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.109931946 CEST192.168.2.51.1.1.10x2d5cStandard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.119380951 CEST192.168.2.51.1.1.10xb2c3Standard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.150700092 CEST192.168.2.51.1.1.10x567fStandard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.346314907 CEST192.168.2.51.1.1.10x39fdStandard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.354146004 CEST192.168.2.51.1.1.10xe4ddStandard query (0)services.addons.mozilla.org28IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.650868893 CEST192.168.2.51.1.1.10x1958Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:37:03.047648907 CEST192.168.2.51.1.1.10x8092Standard query (0)telemetry-incoming.r53-2.services.mozilla.comA (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:37:03.058871031 CEST192.168.2.51.1.1.10xfe8eStandard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false
                                                              Sep 6, 2024 05:37:03.581612110 CEST192.168.2.51.1.1.10xee14Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false

                                                              DNS Answers

                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                              Sep 6, 2024 05:35:57.578176022 CEST1.1.1.1192.168.2.50xa611No error (0)bingadsedgeextension-prod-europe.azurewebsites.netssl.bingadsedgeextension-prod-europe.azurewebsites.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:35:57.578176022 CEST1.1.1.1192.168.2.50xa611No error (0)ssl.bingadsedgeextension-prod-europe.azurewebsites.net94.245.104.56A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:35:57.592367887 CEST1.1.1.1192.168.2.50x1989No error (0)bingadsedgeextension-prod-europe.azurewebsites.netssl.bingadsedgeextension-prod-europe.azurewebsites.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:35:58.317205906 CEST1.1.1.1192.168.2.50xe31fNo error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:35:58.317246914 CEST1.1.1.1192.168.2.50x1fa6No error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.108889103 CEST1.1.1.1192.168.2.50x9d1aNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.108889103 CEST1.1.1.1192.168.2.50x9d1aNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.109185934 CEST1.1.1.1192.168.2.50xca41No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.109185934 CEST1.1.1.1192.168.2.50xca41No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.109232903 CEST1.1.1.1192.168.2.50xde11No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.109641075 CEST1.1.1.1192.168.2.50x6deeNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.162035942 CEST1.1.1.1192.168.2.50xaaaaNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.162035942 CEST1.1.1.1192.168.2.50xaaaaNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.162539005 CEST1.1.1.1192.168.2.50x19ffNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.522696972 CEST1.1.1.1192.168.2.50xf23fNo error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.522696972 CEST1.1.1.1192.168.2.50xf23fNo error (0)googlehosted.l.googleusercontent.com142.250.184.225A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:02.523200989 CEST1.1.1.1192.168.2.50x9045No error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:03.681279898 CEST1.1.1.1192.168.2.50x7995No error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.127366066 CEST1.1.1.1192.168.2.50x5c2dNo error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.680989981 CEST1.1.1.1192.168.2.50xf770No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.680989981 CEST1.1.1.1192.168.2.50xf770No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.690897942 CEST1.1.1.1192.168.2.50xe42eNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:04.700525999 CEST1.1.1.1192.168.2.50x2560No error (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                              Sep 6, 2024 05:36:05.296684027 CEST1.1.1.1192.168.2.50xe719No error (0)example.org93.184.215.14A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:05.301093102 CEST1.1.1.1192.168.2.50x94feNo error (0)ipv4only.arpa192.0.0.170A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:05.301093102 CEST1.1.1.1192.168.2.50x94feNo error (0)ipv4only.arpa192.0.0.171A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:05.301450968 CEST1.1.1.1192.168.2.50x634aNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:05.301450968 CEST1.1.1.1192.168.2.50x634aNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.081548929 CEST1.1.1.1192.168.2.50x7f57No error (0)firefox.settings.services.mozilla.comprod.remote-settings.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.081548929 CEST1.1.1.1192.168.2.50x7f57No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.089304924 CEST1.1.1.1192.168.2.50xdbe3No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.106527090 CEST1.1.1.1192.168.2.50x77b3No error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.106527090 CEST1.1.1.1192.168.2.50x77b3No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.116954088 CEST1.1.1.1192.168.2.50x2d5cNo error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.158060074 CEST1.1.1.1192.168.2.50x567fNo error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.158060074 CEST1.1.1.1192.168.2.50x567fNo error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.158060074 CEST1.1.1.1192.168.2.50x567fNo error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.158060074 CEST1.1.1.1192.168.2.50x567fNo error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.353666067 CEST1.1.1.1192.168.2.50x39fdNo error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.353666067 CEST1.1.1.1192.168.2.50x39fdNo error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.353666067 CEST1.1.1.1192.168.2.50x39fdNo error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.353666067 CEST1.1.1.1192.168.2.50x39fdNo error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.657711983 CEST1.1.1.1192.168.2.50x1958No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:30.657711983 CEST1.1.1.1192.168.2.50x1958No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:32.061470985 CEST1.1.1.1192.168.2.50xacffNo error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:32.061470985 CEST1.1.1.1192.168.2.50xacffNo error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:36:32.526617050 CEST1.1.1.1192.168.2.50x97bbNo error (0)a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.coma17.rackcdn.comCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:36:32.526617050 CEST1.1.1.1192.168.2.50x97bbNo error (0)a17.rackcdn.coma17.rackcdn.com.mdc.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:37:03.034810066 CEST1.1.1.1192.168.2.50x1ef8No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:37:03.054223061 CEST1.1.1.1192.168.2.50x8092No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:37:03.103352070 CEST1.1.1.1192.168.2.50xef92No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                              Sep 6, 2024 05:37:03.588470936 CEST1.1.1.1192.168.2.50xee14No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                              Sep 6, 2024 05:37:03.588470936 CEST1.1.1.1192.168.2.50xee14No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false

                                                              HTTP Request Dependency Graph

                                                              • api.edgeoffer.microsoft.com
                                                              • chrome.cloudflare-dns.com
                                                              • clients2.googleusercontent.com
                                                              • https:
                                                                • accounts.youtube.com
                                                                • www.google.com
                                                              • msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
                                                              • edgeassetservice.azureedge.net
                                                              • fs.microsoft.com
                                                              • slscr.update.microsoft.com
                                                              • detectportal.firefox.com

                                                              HTTP Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.54974134.107.221.82807092C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Sep 6, 2024 05:36:04.688152075 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Sep 6, 2024 05:36:05.134179115 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 09:12:43 GMT
                                                              Age: 66202
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                              Sep 6, 2024 05:36:15.143471956 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:36:25.161668062 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:36:30.548145056 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Sep 6, 2024 05:36:30.644820929 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 09:12:43 GMT
                                                              Age: 66227
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              1192.168.2.54974734.107.221.82807092C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Sep 6, 2024 05:36:05.309238911 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache
                                                              Sep 6, 2024 05:36:05.774008036 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 08:25:25 GMT
                                                              Age: 69040
                                                              Content-Type: text/plain
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success
                                                              Sep 6, 2024 05:36:05.984198093 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 08:25:25 GMT
                                                              Age: 69040
                                                              Content-Type: text/plain
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success
                                                              Sep 6, 2024 05:36:15.798614025 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:36:25.832432985 CEST6OUTData Raw: 00
                                                              Data Ascii:


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              2192.168.2.54977034.107.221.82807092C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Sep 6, 2024 05:36:30.669208050 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache
                                                              Sep 6, 2024 05:36:31.116023064 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 23:45:15 GMT
                                                              Content-Type: text/plain
                                                              Age: 13876
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success
                                                              Sep 6, 2024 05:36:32.527594090 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache
                                                              Sep 6, 2024 05:36:32.621483088 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 23:45:15 GMT
                                                              Content-Type: text/plain
                                                              Age: 13877
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success
                                                              Sep 6, 2024 05:36:32.655339956 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache
                                                              Sep 6, 2024 05:36:32.749960899 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 23:45:15 GMT
                                                              Content-Type: text/plain
                                                              Age: 13877
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success
                                                              Sep 6, 2024 05:36:42.759885073 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:36:52.770781040 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:02.794581890 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:03.919430971 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache
                                                              Sep 6, 2024 05:37:04.013940096 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 23:45:15 GMT
                                                              Content-Type: text/plain
                                                              Age: 13908
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success
                                                              Sep 6, 2024 05:37:14.025645018 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:24.043473959 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:34.053359032 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:44.068392038 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:54.079430103 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:38:04.096659899 CEST6OUTData Raw: 00
                                                              Data Ascii:


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              3192.168.2.54977434.107.221.82807092C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Sep 6, 2024 05:36:32.061419010 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Sep 6, 2024 05:36:32.524913073 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 06:07:14 GMT
                                                              Age: 77358
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                              Sep 6, 2024 05:36:32.551090956 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Sep 6, 2024 05:36:32.651340961 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 06:07:14 GMT
                                                              Age: 77358
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                              Sep 6, 2024 05:36:42.659579039 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:36:52.679228067 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:02.690794945 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:03.581530094 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Sep 6, 2024 05:37:03.680114031 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Thu, 05 Sep 2024 06:07:14 GMT
                                                              Age: 77389
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                              Sep 6, 2024 05:37:13.687086105 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:23.700634003 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:33.717307091 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:43.723176956 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:37:53.747258902 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Sep 6, 2024 05:38:03.764535904 CEST6OUTData Raw: 00
                                                              Data Ascii:


                                                              HTTPS Proxied Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.54971294.245.104.564437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:35:58 UTC428OUTGET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1
                                                              Host: api.edgeoffer.microsoft.com
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:35:58 UTC725INHTTP/1.1 200 OK
                                                              Content-Length: 0
                                                              Connection: close
                                                              Content-Type: application/x-protobuf; charset=utf-8
                                                              Date: Fri, 06 Sep 2024 03:35:58 GMT
                                                              Server: Microsoft-IIS/10.0
                                                              Set-Cookie: ARRAffinity=b2cf461e48ecc93b19cf255be6172c2e255f0b5133c27c015f237c72f4db18e4;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com
                                                              Set-Cookie: ARRAffinity=9abdbd5b78a381dd725259cea1c6bbae9a0ace202d10a3de203c265ae51fd2a1;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com
                                                              Set-Cookie: ARRAffinitySameSite=9abdbd5b78a381dd725259cea1c6bbae9a0ace202d10a3de203c265ae51fd2a1;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com
                                                              Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9
                                                              X-Powered-By: ASP.NET


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              1192.168.2.549725162.159.61.34437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:02 UTC245OUTPOST /dns-query HTTP/1.1
                                                              Host: chrome.cloudflare-dns.com
                                                              Connection: keep-alive
                                                              Content-Length: 128
                                                              Accept: application/dns-message
                                                              Accept-Language: *
                                                              User-Agent: Chrome
                                                              Accept-Encoding: identity
                                                              Content-Type: application/dns-message
                                                              2024-09-06 03:36:02 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom)TP
                                                              2024-09-06 03:36:02 UTC247INHTTP/1.1 200 OK
                                                              Server: cloudflare
                                                              Date: Fri, 06 Sep 2024 03:36:02 GMT
                                                              Content-Type: application/dns-message
                                                              Connection: close
                                                              Access-Control-Allow-Origin: *
                                                              Content-Length: 468
                                                              CF-RAY: 8beb69989ef98c39-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2024-09-06 03:36:02 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcomHc)


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              2192.168.2.549726162.159.61.34437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:02 UTC245OUTPOST /dns-query HTTP/1.1
                                                              Host: chrome.cloudflare-dns.com
                                                              Connection: keep-alive
                                                              Content-Length: 128
                                                              Accept: application/dns-message
                                                              Accept-Language: *
                                                              User-Agent: Chrome
                                                              Accept-Encoding: identity
                                                              Content-Type: application/dns-message
                                                              2024-09-06 03:36:02 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom)TP
                                                              2024-09-06 03:36:02 UTC247INHTTP/1.1 200 OK
                                                              Server: cloudflare
                                                              Date: Fri, 06 Sep 2024 03:36:02 GMT
                                                              Content-Type: application/dns-message
                                                              Connection: close
                                                              Access-Control-Allow-Origin: *
                                                              Content-Length: 468
                                                              CF-RAY: 8beb6998a97e7d00-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2024-09-06 03:36:02 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fe 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom()


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              3192.168.2.549727162.159.61.34437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:02 UTC245OUTPOST /dns-query HTTP/1.1
                                                              Host: chrome.cloudflare-dns.com
                                                              Connection: keep-alive
                                                              Content-Length: 128
                                                              Accept: application/dns-message
                                                              Accept-Language: *
                                                              User-Agent: Chrome
                                                              Accept-Encoding: identity
                                                              Content-Type: application/dns-message
                                                              2024-09-06 03:36:02 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom)TP
                                                              2024-09-06 03:36:02 UTC247INHTTP/1.1 200 OK
                                                              Server: cloudflare
                                                              Date: Fri, 06 Sep 2024 03:36:02 GMT
                                                              Content-Type: application/dns-message
                                                              Connection: close
                                                              Access-Control-Allow-Origin: *
                                                              Content-Length: 468
                                                              CF-RAY: 8beb6998ef96729e-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2024-09-06 03:36:02 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcomHc)


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              4192.168.2.549733142.250.184.2254437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:03 UTC594OUTGET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1
                                                              Host: clients2.googleusercontent.com
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:03 UTC573INHTTP/1.1 200 OK
                                                              Accept-Ranges: bytes
                                                              Content-Length: 135751
                                                              X-GUploader-UploadID: AD-8ljup6TbM7RFBvWc-kCA6OtI7NZOxTGFRr6nRdwjxXDCAgXFN40yyl5B0vtujwUOtH-PxPdv_mwDTvg
                                                              X-Goog-Hash: crc32c=IDdmTg==
                                                              Server: UploadServer
                                                              Date: Thu, 05 Sep 2024 19:15:10 GMT
                                                              Expires: Fri, 05 Sep 2025 19:15:10 GMT
                                                              Cache-Control: public, max-age=31536000
                                                              Age: 30053
                                                              Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT
                                                              ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016
                                                              Content-Type: application/x-chrome-extension
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close
                                                              2024-09-06 03:36:03 UTC817INData Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08
                                                              Data Ascii: Cr240"0*H0^1"wgt2JG1)X4=&?[j,Lzjue[Iq*Ba/XPhL2%3_oH)'=e?j3UH|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
                                                              2024-09-06 03:36:03 UTC1390INData Raw: fd c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d
                                                              Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.|ws+LT>&&Pjanss9ga:SY>
                                                              2024-09-06 03:36:03 UTC1390INData Raw: b0 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad
                                                              Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z|pQ"k<`ZT|uKC1Yg4ewW
                                                              2024-09-06 03:36:03 UTC1390INData Raw: d9 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d
                                                              Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b|wt7nvtD<C}|7e^m?<F\p2uB<Yx9"AI3\[s5y~
                                                              2024-09-06 03:36:03 UTC1390INData Raw: 58 f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb
                                                              Data Ascii: Xwgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:
                                                              2024-09-06 03:36:03 UTC1390INData Raw: 4d 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a
                                                              Data Ascii: Mh3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:
                                                              2024-09-06 03:36:03 UTC1390INData Raw: a0 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82
                                                              Data Ascii: ,ef4=%2n$hgffa,_@uYk|9.Y1+x8aBP|*].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=e*ZkLS65mj}0"$
                                                              2024-09-06 03:36:03 UTC1390INData Raw: 3f ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12
                                                              Data Ascii: ?bpnh"|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF|V1lvgf&3]1g>Lc(s.u
                                                              2024-09-06 03:36:03 UTC1390INData Raw: f9 d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39
                                                              Data Ascii: "P|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9
                                                              2024-09-06 03:36:03 UTC1390INData Raw: 4e 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f
                                                              Data Ascii: NW`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              5192.168.2.549744142.251.41.144437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:05 UTC1081OUTGET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1264983581&timestamp=1725593762981 HTTP/1.1
                                                              Host: accounts.youtube.com
                                                              Connection: keep-alive
                                                              sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"
                                                              sec-ch-ua-mobile: ?0
                                                              sec-ch-ua-full-version: "117.0.5938.132"
                                                              sec-ch-ua-arch: "x86"
                                                              sec-ch-ua-platform: "Windows"
                                                              sec-ch-ua-platform-version: "10.0.0"
                                                              sec-ch-ua-model: ""
                                                              sec-ch-ua-bitness: "64"
                                                              sec-ch-ua-wow64: ?0
                                                              sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"
                                                              Upgrade-Insecure-Requests: 1
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                              Sec-Fetch-Site: cross-site
                                                              Sec-Fetch-Mode: navigate
                                                              Sec-Fetch-Dest: iframe
                                                              Referer: https://accounts.google.com/
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:05 UTC1971INHTTP/1.1 200 OK
                                                              Content-Type: text/html; charset=utf-8
                                                              X-Frame-Options: ALLOW-FROM https://accounts.google.com
                                                              Content-Security-Policy: frame-ancestors https://accounts.google.com
                                                              Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport
                                                              Content-Security-Policy: script-src 'report-sample' 'nonce-U1-3e7FT2-GwH88mgeVnkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self'
                                                              Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist
                                                              Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                              Pragma: no-cache
                                                              Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                              Date: Fri, 06 Sep 2024 03:36:05 GMT
                                                              Cross-Origin-Resource-Policy: cross-origin
                                                              Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                              Cross-Origin-Opener-Policy: same-origin
                                                              Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                              reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjstDikmLw15BikPj6kkkDiJ3SZ7AGAXHSv_OsRUC8JOIi66HEi6yXuy-xXgdi1Z5LrKZALMTDsfTjy21sAh2_n_xkVNJLyi-Mz0xJzSvJLKlMyc9NzMxLzs_PzkwtLk4tKkstijcyMDIxsDQw1DOwiC8wAABLDC8-"
                                                              Server: ESF
                                                              X-XSS-Protection: 0
                                                              X-Content-Type-Options: nosniff
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Accept-Ranges: none
                                                              Vary: Accept-Encoding
                                                              Connection: close
                                                              Transfer-Encoding: chunked
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 37 36 30 34 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 55 31 2d 33 65 37 46 54 32 2d 47 77 48 38 38 6d 67 65 56 6e 6b 77 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f
                                                              Data Ascii: 7604<html><head><script nonce="U1-3e7FT2-GwH88mgeVnkw">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs||{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28 28 2e
                                                              Data Ascii: ident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s*(?:\\((.
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 6f 6e 28 61 2c 62 2c 63 29 7b 61 3d 3d 6e 75 6c 6c 26 26 28 61 3d 79 61 29 3b 79 61 3d 76 6f 69 64 20 30 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 64 3d 39 36 3b 63 3f 28 61 3d 5b 63 5d 2c 64 7c 3d 35 31 32 29 3a 61 3d 5b 5d 3b 62 26 26 28 64 3d 64 26 2d 31 36 37 36 30 38 33 33 7c 0a 28 62 26 31 30 32 33 29 3c 3c 31 34 29 7d 65 6c 73 65 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6e 22 29 3b 64 3d 7a 28 61 29 3b 69 66 28 64 26 32 30 34 38 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6f 22 29 3b 69 66 28 64 26 36 34 29 72 65 74 75 72 6e 20 61 3b 64 7c 3d 36 34 3b 69 66 28 63 26 26 28 64 7c 3d 35 31 32 2c 63 21 3d 3d 61 5b 30 5d 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 70 22 29 3b 61 3a
                                                              Data Ascii: on(a,b,c){a==null&&(a=ya);ya=void 0;if(a==null){var d=96;c?(a=[c],d|=512):a=[];b&&(d=d&-16760833|(b&1023)<<14)}else{if(!Array.isArray(a))throw Error("n");d=z(a);if(d&2048)throw Error("o");if(d&64)return a;d|=64;if(c&&(d|=512,c!==a[0]))throw Error("p");a:
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 43 3f 61 2e 4a 3a 4b 61 28 61 2e 4a 2c 4e 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 76 61 72 20 62 3d 21 43 2c 63 3d 61 2e 6c 65 6e 67 74 68 3b 69 66 28 63 29 7b 76 61 72 20 64 3d 61 5b 63 2d 31 5d 2c 65 3d 77 61 28 64 29 3b 65 3f 63 2d 2d 3a 64 3d 76 6f 69 64 20 30 3b 76 61 72 20 66 3d 61 3b 69 66 28 65 29 7b 62 3a 7b 76 61 72 20 68 3d 64 3b 76 61 72 20 67 3d 7b 7d 3b 65 3d 21 31 3b 69 66 28 68 29 66 6f 72 28 76 61 72 20 6b 20 69 6e 20 68 29 69 66 28 69 73 4e 61 4e 28 2b 6b 29 29 67 5b 6b 5d 3d 0a 68 5b 6b 5d 3b 65 6c 73 65 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6c 29 26 26 28 41 28 6c 29 7c 7c 76 61 28 6c 29 26 26 6c 2e 73 69 7a 65 3d 3d 3d 30 29 26 26 28 6c 3d
                                                              Data Ascii: nction(a){a=C?a.J:Ka(a.J,Na,void 0,void 0,!1);var b=!C,c=a.length;if(c){var d=a[c-1],e=wa(d);e?c--:d=void 0;var f=a;if(e){b:{var h=d;var g={};e=!1;if(h)for(var k in h)if(isNaN(+k))g[k]=h[k];else{var l=h[k];Array.isArray(l)&&(A(l)||va(l)&&l.size===0)&&(l=
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 44 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 54 61 28 51 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 0a 76 61 72 20 54 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 2c 46 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d
                                                              Data Ascii: eof d==="function"&&typeof d.prototype[a]!="function"&&D(d.prototype,a,{configurable:!0,writable:!0,value:function(){return Ta(Qa(this))}})}return a});var Ta=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a},F=function(a){var b=
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 47 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 47 28 6b 2c 66 29 3f 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3a 76 6f 69 64 20 30 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 47 28 6b 2c 66 29 26 26 47 28 6b 5b 66 5d 2c 74 68 69 73 2e 67 29 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 0a 47 28 6b 2c 66 29
                                                              Data Ascii: ("i");d(k);if(!G(k,f))throw Error("j`"+k);k[f][this.g]=l;return this};g.prototype.get=function(k){return c(k)&&G(k,f)?k[f][this.g]:void 0};g.prototype.has=function(k){return c(k)&&G(k,f)&&G(k[f],this.g)};g.prototype.delete=function(k){return c(k)&&G(k,f)
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d 5b 6c 5d 3b 69 66 28 6d 26 26 47 28 67 5b 30 5d 2c 6c 29 29 66 6f 72 28 67 3d 30 3b 67 3c 6d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 7b 76 61 72 20 71 3d 6d 5b 67 5d 3b 69 66 28 6b 21 3d 3d 6b 26 26 71 2e 6b 65 79 21 3d 3d 71 2e 6b 65 79 7c 7c 6b 3d 3d 3d 71 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 67 2c 6c 3a 71 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 2d 31 2c 6c 3a 76 6f 69 64 20 30 7d 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20
                                                              Data Ascii: ="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0][l];if(m&&G(g[0],l))for(g=0;g<m.length;g++){var q=m[g];if(k!==k&&q.key!==q.key||k===q.key)return{id:l,list:m,index:g,l:q}}return{id:l,list:m,index:-1,l:void 0}},e=function(g,k){var
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 7b 69 66 28 21 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 29 3b 69 66 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 29 7b 76 61 72 20 64 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 32 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 3b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 75 6e 73 68 69 66 74 2e 61 70 70 6c 79 28 65 2c 64 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 62 2c 65 29 7d 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 62 2c 0a 61 72 67 75 6d 65 6e 74 73 29 7d
                                                              Data Ascii: {if(!a)throw Error();if(arguments.length>2){var d=Array.prototype.slice.call(arguments,2);return function(){var e=Array.prototype.slice.call(arguments);Array.prototype.unshift.apply(e,d);return a.apply(b,e)}}return function(){return a.apply(b,arguments)}
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 6c 69 6e 65 7c 7c 22 4e 6f 74 20 61 76 61 69 6c 61 62 6c 65 22 7d 63 61 74 63 68 28 66 29 7b 64 3d 22 4e 6f 74 20 61 76 61 69 6c 61 62 6c 65 22 2c 63 3d 21 30 7d 74 72 79 7b 76 61 72 20 65 3d 61 2e 66 69 6c 65 4e 61 6d 65 7c 7c 0a 61 2e 66 69 6c 65 6e 61 6d 65 7c 7c 61 2e 73 6f 75 72 63 65 55 52 4c 7c 7c 72 2e 24 67 6f 6f 67 44 65 62 75 67 46 6e 61 6d 65 7c 7c 62 7d 63 61 74 63 68 28 66 29 7b 65 3d 22 4e 6f 74 20 61 76 61 69 6c 61 62 6c 65 22 2c 63 3d 21 30 7d 62 3d 6e 62 28 61 29 3b 72 65 74 75 72 6e 21 63 26 26 61 2e 6c 69 6e 65 4e 75 6d 62 65 72 26 26 61 2e 66 69 6c 65 4e 61 6d 65 26 26 61 2e 73 74 61 63 6b 26 26 61 2e 6d 65 73 73 61 67 65 26 26 61 2e 6e 61 6d 65 3f 7b 6d 65 73 73 61 67 65 3a 61 2e 6d 65 73 73 61 67 65 2c 6e 61 6d 65 3a 61 2e 6e 61 6d
                                                              Data Ascii: line||"Not available"}catch(f){d="Not available",c=!0}try{var e=a.fileName||a.filename||a.sourceURL||r.$googDebugFname||b}catch(f){e="Not available",c=!0}b=nb(a);return!c&&a.lineNumber&&a.fileName&&a.stack&&a.message&&a.name?{message:a.message,name:a.nam
                                                              2024-09-06 03:36:05 UTC1971INData Raw: 72 20 74 62 3d 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5b 5e 3a 2f 3f 23 2e 5d 2b 29 3a 29 3f 28 3f 3a 2f 2f 28 3f 3a 28 5b 5e 5c 5c 5c 5c 2f 3f 23 5d 2a 29 40 29 3f 28 5b 5e 5c 5c 5c 5c 2f 3f 23 5d 2a 3f 29 28 3f 3a 3a 28 5b 30 2d 39 5d 2b 29 29 3f 28 3f 3d 5b 5c 5c 5c 5c 2f 3f 23 5d 7c 24 29 29 3f 28 5b 5e 3f 23 5d 2b 29 3f 28 3f 3a 5c 5c 3f 28 5b 5e 23 5d 2a 29 29 3f 28 3f 3a 23 28 5b 5c 5c 73 5c 5c 53 5d 2a 29 29 3f 24 22 29 2c 75 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 21 62 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 63 3d 61 2e 69 6e 64 65 78 4f 66 28 22 23 22 29 3b 63 3c 30 26 26 28 63 3d 61 2e 6c 65 6e 67 74 68 29 3b 76 61 72 20 64 3d 61 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 3b 69 66 28 64 3c 30 7c 7c 64 3e 63 29 7b 64 3d 63 3b 76
                                                              Data Ascii: r tb=RegExp("^(?:([^:/?#.]+):)?(?://(?:([^\\\\/?#]*)@)?([^\\\\/?#]*?)(?::([0-9]+))?(?=[\\\\/?#]|$))?([^?#]+)?(?:\\?([^#]*))?(?:#([\\s\\S]*))?$"),ub=function(a,b){if(!b)return a;var c=a.indexOf("#");c<0&&(c=a.length);var d=a.indexOf("?");if(d<0||d>c){d=c;v


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              6192.168.2.549742184.28.90.27443
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:05 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                                              Connection: Keep-Alive
                                                              Accept: */*
                                                              Accept-Encoding: identity
                                                              User-Agent: Microsoft BITS/7.8
                                                              Host: fs.microsoft.com
                                                              2024-09-06 03:36:05 UTC466INHTTP/1.1 200 OK
                                                              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                              Content-Type: application/octet-stream
                                                              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                              Server: ECAcc (lpl/EF67)
                                                              X-CID: 11
                                                              X-Ms-ApiVersion: Distribute 1.2
                                                              X-Ms-Region: prod-weu-z1
                                                              Cache-Control: public, max-age=47375
                                                              Date: Fri, 06 Sep 2024 03:36:05 GMT
                                                              Connection: close
                                                              X-CID: 2


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              7192.168.2.549745152.195.19.974437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:05 UTC614OUTGET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726198560&P2=404&P3=2&P4=N4ca5ZcfSGhJ5Pwwpq4arg18zjS6DdIPQzhglCHhlbgc05jprPBqHuMmtEztXM9sul%2b7TDqpNoKFeDLFIvctgA%3d%3d HTTP/1.1
                                                              Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
                                                              Connection: keep-alive
                                                              MS-CV: AHnfzUw9D9vLWxoi2gC2pl
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:05 UTC632INHTTP/1.1 200 OK
                                                              Accept-Ranges: bytes
                                                              Age: 5520296
                                                              Cache-Control: public, max-age=17280000
                                                              Content-Type: application/x-chrome-extension
                                                              Date: Fri, 06 Sep 2024 03:36:05 GMT
                                                              Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8="
                                                              Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT
                                                              MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31
                                                              MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0
                                                              MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4
                                                              Server: ECAcc (nyd/D11E)
                                                              X-AspNet-Version: 4.0.30319
                                                              X-AspNetMvc-Version: 5.3
                                                              X-Cache: HIT
                                                              X-CCC: US
                                                              X-CID: 11
                                                              X-Powered-By: ASP.NET
                                                              X-Powered-By: ARR/3.0
                                                              X-Powered-By: ASP.NET
                                                              Content-Length: 11185
                                                              Connection: close
                                                              2024-09-06 03:36:05 UTC11185INData Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20
                                                              Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              8192.168.2.54974313.107.246.404437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:05 UTC470OUTGET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Edge-Asset-Group: Shoreline
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:05 UTC577INHTTP/1.1 200 OK
                                                              Date: Fri, 06 Sep 2024 03:36:05 GMT
                                                              Content-Type: application/octet-stream
                                                              Content-Length: 306698
                                                              Connection: close
                                                              Content-Encoding: gzip
                                                              Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT
                                                              ETag: 0x8DBC9B5C40EBFF4
                                                              x-ms-request-id: a05cbbc2-a01e-0025-3785-fef0b4000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240906T033605Z-16579567576gnfmq2acf56mm700000000d5000000000gf6w
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 0
                                                              X-Cache-Info: L1_T2
                                                              X-Cache: TCP_HIT
                                                              Accept-Ranges: bytes
                                                              2024-09-06 03:36:05 UTC15807INData Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe
                                                              Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&|'J'~eL|&c~6{JAw^z3cUEeMaTu W/^~b|X_?r~vXwW
                                                              2024-09-06 03:36:05 UTC16384INData Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c
                                                              Data Ascii: u&U\h|[T[%6Q+"PR6mU5YgV-HoB /!~qL|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz|PVM&UOu~{-oM5QafAp
                                                              2024-09-06 03:36:05 UTC16384INData Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d
                                                              Data Ascii: ,(T$&O7gkD$>U|}mlBxz*BFSzP~|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)|[U35QTB-
                                                              2024-09-06 03:36:05 UTC16384INData Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80
                                                              Data Ascii: *B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:*_Gp`n3.e_j;`?ihbE}*Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqP
                                                              2024-09-06 03:36:05 UTC16384INData Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e
                                                              Data Ascii: kp4k@?lk/IyMR\!1Q|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0o*j~~{Y1U}n|?*4>tk,OS]|w}:)y7gg3r#YU]oU~Cl.V
                                                              2024-09-06 03:36:05 UTC16384INData Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7
                                                              Data Ascii: {M1eIwyfr;Tt5S};PtEr~*uVOLC=A{5__p*tHt|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
                                                              2024-09-06 03:36:05 UTC16384INData Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1
                                                              Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
                                                              2024-09-06 03:36:05 UTC16384INData Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03
                                                              Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
                                                              2024-09-06 03:36:05 UTC16384INData Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40
                                                              Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;|.'Ocl7vUh&n{G]%vHN@
                                                              2024-09-06 03:36:05 UTC16384INData Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6
                                                              Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0*"1OvD#jK_F(Mu,abs&0`K`|'5Z:-#BoFX1-3JESJY(bJX*@D[93&Pq<jy@^2%S^?`>


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              9192.168.2.54974613.107.246.404437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:05 UTC711OUTGET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Edge-Asset-Group: EntityExtractionDomainsConfig
                                                              Sec-Mesh-Client-Edge-Version: 117.0.2045.47
                                                              Sec-Mesh-Client-Edge-Channel: stable
                                                              Sec-Mesh-Client-OS: Windows
                                                              Sec-Mesh-Client-OS-Version: 10.0.19045
                                                              Sec-Mesh-Client-Arch: x86_64
                                                              Sec-Mesh-Client-WebView: 0
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:05 UTC583INHTTP/1.1 200 OK
                                                              Date: Fri, 06 Sep 2024 03:36:05 GMT
                                                              Content-Type: application/octet-stream
                                                              Content-Length: 70207
                                                              Connection: close
                                                              Content-Encoding: gzip
                                                              Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT
                                                              ETag: 0x8DCB31E67C22927
                                                              x-ms-request-id: ed2d6e16-301e-006f-0748-ffc0d3000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240906T033605Z-16579567576vmrmh31x74mnmgs000000050000000000fp0x
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-09-06 03:36:05 UTC15801INData Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7
                                                              Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
                                                              2024-09-06 03:36:06 UTC16384INData Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31
                                                              Data Ascii: JEq*b,0Rte*|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;|a``|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
                                                              2024-09-06 03:36:06 UTC16384INData Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63
                                                              Data Ascii: /M5?Rg|M kt|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX*$Nkct&iZ%b8Zoj@ u2OgA1DG3*5d*lg|9GV>OVzVMPA76.|c
                                                              2024-09-06 03:36:06 UTC16384INData Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81
                                                              Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
                                                              2024-09-06 03:36:06 UTC5254INData Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83
                                                              Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              10192.168.2.549749142.250.176.2064437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:06 UTC561OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                              Host: play.google.com
                                                              Connection: keep-alive
                                                              Accept: */*
                                                              Access-Control-Request-Method: POST
                                                              Access-Control-Request-Headers: x-goog-authuser
                                                              Origin: https://accounts.google.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                              Sec-Fetch-Mode: cors
                                                              Sec-Fetch-Site: same-site
                                                              Sec-Fetch-Dest: empty
                                                              Referer: https://accounts.google.com/
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:06 UTC520INHTTP/1.1 200 OK
                                                              Access-Control-Allow-Origin: https://accounts.google.com
                                                              Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                              Access-Control-Max-Age: 86400
                                                              Access-Control-Allow-Credentials: true
                                                              Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                              Content-Type: text/plain; charset=UTF-8
                                                              Date: Fri, 06 Sep 2024 03:36:06 GMT
                                                              Server: Playlog
                                                              Content-Length: 0
                                                              X-XSS-Protection: 0
                                                              X-Frame-Options: SAMEORIGIN
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              11192.168.2.549748142.250.176.2064437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:06 UTC561OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                              Host: play.google.com
                                                              Connection: keep-alive
                                                              Accept: */*
                                                              Access-Control-Request-Method: POST
                                                              Access-Control-Request-Headers: x-goog-authuser
                                                              Origin: https://accounts.google.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                              Sec-Fetch-Mode: cors
                                                              Sec-Fetch-Site: same-site
                                                              Sec-Fetch-Dest: empty
                                                              Referer: https://accounts.google.com/
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:06 UTC520INHTTP/1.1 200 OK
                                                              Access-Control-Allow-Origin: https://accounts.google.com
                                                              Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                              Access-Control-Max-Age: 86400
                                                              Access-Control-Allow-Credentials: true
                                                              Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                              Content-Type: text/plain; charset=UTF-8
                                                              Date: Fri, 06 Sep 2024 03:36:06 GMT
                                                              Server: Playlog
                                                              Content-Length: 0
                                                              X-XSS-Protection: 0
                                                              X-Frame-Options: SAMEORIGIN
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              12192.168.2.549750184.28.90.27443
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:06 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                                              Connection: Keep-Alive
                                                              Accept: */*
                                                              Accept-Encoding: identity
                                                              If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                              Range: bytes=0-2147483646
                                                              User-Agent: Microsoft BITS/7.8
                                                              Host: fs.microsoft.com
                                                              2024-09-06 03:36:06 UTC514INHTTP/1.1 200 OK
                                                              ApiVersion: Distribute 1.1
                                                              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                              Content-Type: application/octet-stream
                                                              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                              Server: ECAcc (lpl/EF06)
                                                              X-CID: 11
                                                              X-Ms-ApiVersion: Distribute 1.2
                                                              X-Ms-Region: prod-weu-z1
                                                              Cache-Control: public, max-age=47428
                                                              Date: Fri, 06 Sep 2024 03:36:06 GMT
                                                              Content-Length: 55
                                                              Connection: close
                                                              X-CID: 2
                                                              2024-09-06 03:36:06 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                              Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              13192.168.2.549756142.251.32.1004437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:07 UTC881OUTGET /favicon.ico HTTP/1.1
                                                              Host: www.google.com
                                                              Connection: keep-alive
                                                              sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"
                                                              sec-ch-ua-mobile: ?0
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                              sec-ch-ua-arch: "x86"
                                                              sec-ch-ua-full-version: "117.0.5938.132"
                                                              sec-ch-ua-platform-version: "10.0.0"
                                                              sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"
                                                              sec-ch-ua-bitness: "64"
                                                              sec-ch-ua-model: ""
                                                              sec-ch-ua-wow64: ?0
                                                              sec-ch-ua-platform: "Windows"
                                                              Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                              Sec-Fetch-Site: same-site
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: image
                                                              Referer: https://accounts.google.com/
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:07 UTC704INHTTP/1.1 200 OK
                                                              Accept-Ranges: bytes
                                                              Cross-Origin-Resource-Policy: cross-origin
                                                              Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
                                                              Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
                                                              Content-Length: 5430
                                                              X-Content-Type-Options: nosniff
                                                              Server: sffe
                                                              X-XSS-Protection: 0
                                                              Date: Fri, 06 Sep 2024 03:29:17 GMT
                                                              Expires: Sat, 14 Sep 2024 03:29:17 GMT
                                                              Cache-Control: public, max-age=691200
                                                              Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
                                                              Content-Type: image/x-icon
                                                              Vary: Accept-Encoding
                                                              Age: 410
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close
                                                              2024-09-06 03:36:07 UTC686INData Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff
                                                              Data Ascii: h& ( 0.v]X:X:rY
                                                              2024-09-06 03:36:07 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb
                                                              Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
                                                              2024-09-06 03:36:07 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc
                                                              Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
                                                              2024-09-06 03:36:07 UTC1390INData Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                              Data Ascii: BBBBBBF!4I
                                                              2024-09-06 03:36:07 UTC574INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                              Data Ascii: $'


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              14192.168.2.54975913.107.246.404437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:08 UTC478OUTGET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Edge-Asset-Group: ProductCategories
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:36:08 UTC559INHTTP/1.1 200 OK
                                                              Date: Fri, 06 Sep 2024 03:36:08 GMT
                                                              Content-Type: application/octet-stream
                                                              Content-Length: 82989
                                                              Connection: close
                                                              Last-Modified: Thu, 25 May 2023 20:28:02 GMT
                                                              ETag: 0x8DB5D5E89CE25EB
                                                              x-ms-request-id: f9285315-801e-0010-24d3-ff5ee1000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240906T033608Z-165795675762gt5gbs4b9bazh80000000d1000000000m3h7
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-09-06 03:36:08 UTC15825INData Raw: 0a 22 08 f2 33 12 1d 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 0d 42 65 6c 74 73 20 26 20 48 6f 73 65 73 0a 23 08 d7 2b 12 1e 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 09 41 69 72 20 50 75 6d 70 73 0a 21 08 b8 22 12 1c 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 0c 42 6f 64 79 20 53 74 79 6c 69 6e 67 0a 34 08 c3 35 12 2f 0a 18 47 6f 75 72 6d 65 74 20 46 6f 6f 64 20 26 20 43 68 6f 63 6f 6c 61 74 65 12 13 53 70 69 63 65 73 20 26 20 53 65 61 73 6f 6e 69 6e 67 73 0a 27 08 a4 2c 12 22 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 0d 53 6c 65 65 70 69 6e 67 20 47 65 61 72 0a 21 08 f5 36 12 1c 0a 0d 4c 61 77 6e 20 26 20 47 61 72 64 65 6e 12 0b 48 79 64 72 6f 70 6f 6e 69 63 73 0a 39 08 61 12 35 0a 11 42 6f 6f 6b 73 20 26 20 4d
                                                              Data Ascii: "3Car & GarageBelts & Hoses#+Sports & OutdoorsAir Pumps!"Car & GarageBody Styling45/Gourmet Food & ChocolateSpices & Seasonings',"Sports & OutdoorsSleeping Gear!6Lawn & GardenHydroponics9a5Books & M
                                                              2024-09-06 03:36:08 UTC16384INData Raw: 69 64 65 6f 20 47 61 6d 65 73 12 1b 4e 69 6e 74 65 6e 64 6f 20 53 79 73 74 65 6d 20 41 63 63 65 73 73 6f 72 69 65 73 0a 20 08 a2 26 12 1b 0a 10 54 6f 6f 6c 73 20 26 20 48 61 72 64 77 61 72 65 12 07 54 6f 69 6c 65 74 73 0a 2c 08 f3 28 12 27 0a 14 4b 69 74 63 68 65 6e 20 26 20 48 6f 75 73 65 77 61 72 65 73 12 0f 45 6c 65 63 74 72 69 63 20 4d 69 78 65 72 73 0a 21 08 c0 32 12 1c 0a 04 54 6f 79 73 12 14 53 61 6e 64 62 6f 78 20 26 20 42 65 61 63 68 20 54 6f 79 73 0a 35 08 a5 25 12 30 0a 18 47 6f 75 72 6d 65 74 20 46 6f 6f 64 20 26 20 43 68 6f 63 6f 6c 61 74 65 12 14 53 65 61 66 6f 6f 64 20 43 6f 6d 62 69 6e 61 74 69 6f 6e 73 0a 24 08 d7 27 12 1f 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 0b 43 61 6b 65 20 53 74 61 6e 64 73 0a 2e 08 a4 28 12 29 0a
                                                              Data Ascii: ideo GamesNintendo System Accessories &Tools & HardwareToilets,('Kitchen & HousewaresElectric Mixers!2ToysSandbox & Beach Toys5%0Gourmet Food & ChocolateSeafood Combinations$'Home FurnishingsCake Stands.()
                                                              2024-09-06 03:36:08 UTC16384INData Raw: 26 20 47 61 72 61 67 65 12 1c 44 72 69 76 65 77 61 79 20 26 20 47 61 72 61 67 65 20 46 6c 6f 6f 72 20 43 61 72 65 0a 25 08 f0 2a 12 20 0a 0f 4f 66 66 69 63 65 20 50 72 6f 64 75 63 74 73 12 0d 50 61 70 65 72 20 50 75 6e 63 68 65 73 0a 2d 08 c1 2c 12 28 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 13 42 69 63 79 63 6c 65 20 41 63 63 65 73 73 6f 72 69 65 73 0a 22 08 a2 27 12 1d 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 09 4e 6f 76 65 6c 74 69 65 73 0a 16 08 f3 29 12 11 0a 05 4d 75 73 69 63 12 08 45 78 65 72 63 69 73 65 0a 22 08 8e 31 12 1d 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 08 53 77 69 6d 6d 69 6e 67 0a 26 08 d4 21 12 21 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 0b 4d 61 6b 65 75 70
                                                              Data Ascii: & GarageDriveway & Garage Floor Care%* Office ProductsPaper Punches-,(Sports & OutdoorsBicycle Accessories"'Home FurnishingsNovelties)MusicExercise"1Sports & OutdoorsSwimming&!!Beauty & FragranceMakeup
                                                              2024-09-06 03:36:08 UTC16384INData Raw: 6f 63 6b 20 50 61 72 74 73 0a 1b 08 be 29 12 16 0a 0d 4c 61 77 6e 20 26 20 47 61 72 64 65 6e 12 05 42 75 6c 62 73 0a 21 08 a3 21 12 1c 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 06 4d 61 6b 65 75 70 0a 2d 08 49 12 29 0a 11 42 6f 6f 6b 73 20 26 20 4d 61 67 61 7a 69 6e 65 73 12 14 42 75 73 69 6e 65 73 73 20 26 20 45 63 6f 6e 6f 6d 69 63 73 0a 23 08 d5 23 12 1e 0a 09 43 6f 6d 70 75 74 69 6e 67 12 11 45 78 70 61 6e 73 69 6f 6e 20 4d 6f 64 75 6c 65 73 0a 2f 08 a2 24 12 2a 0a 0b 45 6c 65 63 74 72 6f 6e 69 63 73 12 1b 43 44 20 50 6c 61 79 65 72 73 20 26 20 53 74 65 72 65 6f 20 53 79 73 74 65 6d 73 0a 1f 08 d4 26 12 1a 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 06 51 75 69 6c 74 73 0a 22 08 86 23 12 1d 0a 10 43 6c 6f 74 68 69 6e
                                                              Data Ascii: ock Parts)Lawn & GardenBulbs!!Beauty & FragranceMakeup-I)Books & MagazinesBusiness & Economics##ComputingExpansion Modules/$*ElectronicsCD Players & Stereo Systems&Home FurnishingsQuilts"#Clothin
                                                              2024-09-06 03:36:08 UTC16384INData Raw: 65 72 73 0a 27 08 a6 2c 12 22 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 0d 53 6c 65 65 70 69 6e 67 20 42 61 67 73 0a 24 08 bd 21 12 1f 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 09 46 72 61 67 72 61 6e 63 65 0a 28 08 63 12 24 0a 11 42 6f 6f 6b 73 20 26 20 4d 61 67 61 7a 69 6e 65 73 12 0f 4d 75 73 69 63 20 4d 61 67 61 7a 69 6e 65 73 0a 1e 08 8a 2b 12 19 0a 0f 4f 66 66 69 63 65 20 50 72 6f 64 75 63 74 73 12 06 52 75 6c 65 72 73 0a 2d 08 a9 33 12 28 0a 09 43 6f 6d 70 75 74 69 6e 67 12 1b 50 72 69 6e 74 65 72 20 50 61 72 74 73 20 26 20 41 74 74 61 63 68 6d 65 6e 74 73 0a 27 08 ef 23 12 22 0a 09 43 6f 6d 70 75 74 69 6e 67 12 15 54 68 69 6e 20 43 6c 69 65 6e 74 20 43 6f 6d 70 75 74 65 72 73 0a 37 08 bc 24 12 32 0a 0b 45 6c
                                                              Data Ascii: ers',"Sports & OutdoorsSleeping Bags$!Beauty & FragranceFragrance(c$Books & MagazinesMusic Magazines+Office ProductsRulers-3(ComputingPrinter Parts & Attachments'#"ComputingThin Client Computers7$2El
                                                              2024-09-06 03:36:08 UTC1628INData Raw: 0b 44 56 44 20 50 6c 61 79 65 72 73 0a 34 08 dc 36 12 2f 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 1f 53 6e 6f 77 6d 6f 62 69 6c 65 20 26 20 41 54 56 20 53 6b 69 73 20 26 20 52 75 6e 6e 65 72 73 0a 23 08 a2 21 12 1e 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 08 54 77 65 65 7a 65 72 73 0a 30 08 8e 33 12 2b 0a 0c 50 65 74 20 53 75 70 70 6c 69 65 73 12 1b 50 65 74 20 48 61 62 69 74 61 74 20 26 20 43 61 67 65 20 53 75 70 70 6c 69 65 73 0a 29 08 d4 23 12 24 0a 09 43 6f 6d 70 75 74 69 6e 67 12 17 44 69 67 69 74 61 6c 20 4d 65 64 69 61 20 52 65 63 65 69 76 65 72 73 0a 2a 08 f3 2b 12 25 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 10 42 6f 61 74 20 4d 61 69 6e 74 65 6e 61 6e 63 65 0a 22 08 d7 26 12 1d 0a 10 48 6f 6d 65 20 46
                                                              Data Ascii: DVD Players46/Car & GarageSnowmobile & ATV Skis & Runners#!Beauty & FragranceTweezers03+Pet SuppliesPet Habitat & Cage Supplies)#$ComputingDigital Media Receivers*+%Sports & OutdoorsBoat Maintenance"&Home F


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              15192.168.2.54976013.85.23.86443
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:13 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RVwYmNT3spD2U6f&MD=aTXgpPoz HTTP/1.1
                                                              Connection: Keep-Alive
                                                              Accept: */*
                                                              User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                              Host: slscr.update.microsoft.com
                                                              2024-09-06 03:36:13 UTC560INHTTP/1.1 200 OK
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Content-Type: application/octet-stream
                                                              Expires: -1
                                                              Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                              ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                              MS-CorrelationId: 99049387-ba81-4bfd-99b8-603da238e463
                                                              MS-RequestId: 7f0ca2b0-8949-45a6-98e6-15258f596c62
                                                              MS-CV: wJIlSvdvnk+m/h/l.0
                                                              X-Microsoft-SLSClientCache: 2880
                                                              Content-Disposition: attachment; filename=environment.cab
                                                              X-Content-Type-Options: nosniff
                                                              Date: Fri, 06 Sep 2024 03:36:12 GMT
                                                              Connection: close
                                                              Content-Length: 24490
                                                              2024-09-06 03:36:13 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                              Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                              2024-09-06 03:36:13 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                              Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              16192.168.2.54977713.85.23.86443
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:51 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RVwYmNT3spD2U6f&MD=aTXgpPoz HTTP/1.1
                                                              Connection: Keep-Alive
                                                              Accept: */*
                                                              User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                              Host: slscr.update.microsoft.com
                                                              2024-09-06 03:36:51 UTC560INHTTP/1.1 200 OK
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Content-Type: application/octet-stream
                                                              Expires: -1
                                                              Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                              ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440"
                                                              MS-CorrelationId: 0c71f2de-fb06-4844-adcf-afa20c6ce1d7
                                                              MS-RequestId: 7ca85bbb-c3f3-4bf0-bf08-c1a82b652f60
                                                              MS-CV: hPpy7sVpVEuA2hfc.0
                                                              X-Microsoft-SLSClientCache: 1440
                                                              Content-Disposition: attachment; filename=environment.cab
                                                              X-Content-Type-Options: nosniff
                                                              Date: Fri, 06 Sep 2024 03:36:51 GMT
                                                              Connection: close
                                                              Content-Length: 30005
                                                              2024-09-06 03:36:51 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e
                                                              Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
                                                              2024-09-06 03:36:51 UTC14181INData Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f
                                                              Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              17192.168.2.54977923.219.161.1324437716C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-09-06 03:36:59 UTC442OUTOPTIONS /api/report?cat=bingbusiness HTTP/1.1
                                                              Host: bzib.nelreports.net
                                                              Connection: keep-alive
                                                              Origin: https://business.bing.com
                                                              Access-Control-Request-Method: POST
                                                              Access-Control-Request-Headers: content-type
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-09-06 03:37:32 UTC354INHTTP/1.1 502 Bad Gateway
                                                              Content-Length: 1477
                                                              Content-Type: text/html
                                                              Date: Fri, 06 Sep 2024 03:37:32 GMT
                                                              Connection: close
                                                              PMUSER_FORMAT_QS:
                                                              X-CDN-TraceId: 0.84112317.1725593819.1a5e3f05
                                                              Access-Control-Allow-Credentials: false
                                                              Access-Control-Allow-Methods: *
                                                              Access-Control-Allow-Methods: GET, OPTIONS, POST
                                                              Access-Control-Allow-Origin: *
                                                              2024-09-06 03:37:32 UTC1477INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 35 30 32 20 2d 20 57 65 62
                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>502 - Web


                                                              Statistics

                                                              CPU Usage

                                                              Click to jump to process

                                                              Memory Usage

                                                              Click to jump to process

                                                              High Level Behavior Distribution

                                                              Click to dive into process behavior distribution

                                                              Behavior

                                                              Click to jump to process

                                                              System Behavior

                                                              General

                                                              Target ID:0
                                                              Start time:23:35:52
                                                              Start date:05/09/2024
                                                              Path:C:\Users\user\Desktop\file.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Users\user\Desktop\file.exe"
                                                              Imagebase:0x770000
                                                              File size:917'504 bytes
                                                              MD5 hash:03C318CDB19AB95C6214DE1D5BFEF1DF
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:low
                                                              Has exited:true

                                                              General

                                                              Target ID:2
                                                              Start time:23:35:53
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:3
                                                              Start time:23:35:53
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                              Imagebase:0x7ff79f9e0000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:4
                                                              Start time:23:35:53
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation
                                                              Imagebase:0x7ff79f9e0000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:6
                                                              Start time:23:35:53
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                              Imagebase:0x7ff79f9e0000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:false

                                                              General

                                                              Target ID:7
                                                              Start time:23:35:53
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2020,i,2576952469324847178,13305094956544838647,262144 /prefetch:3
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:8
                                                              Start time:23:35:54
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:false

                                                              General

                                                              Target ID:9
                                                              Start time:23:35:55
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:3
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:false

                                                              General

                                                              Target ID:11
                                                              Start time:23:35:58
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2248 -parentBuildID 20230927232528 -prefsHandle 2180 -prefMapHandle 2160 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9226e162-6336-4180-a447-236efcf9b96e} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2240a36e510 socket
                                                              Imagebase:0x7ff79f9e0000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:false

                                                              General

                                                              Target ID:14
                                                              Start time:23:36:00
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7008 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:15
                                                              Start time:23:36:01
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7156 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:16
                                                              Start time:23:36:02
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -parentBuildID 20230927232528 -prefsHandle 4280 -prefMapHandle 3920 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {492a3418-b3b9-49ea-8fda-7229f54742bd} 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 2241d32cc10 rdd
                                                              Imagebase:0x7ff79f9e0000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:false

                                                              General

                                                              Target ID:17
                                                              Start time:23:36:04
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4964 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:18
                                                              Start time:23:36:04
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7960 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:19
                                                              Start time:23:36:05
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=8148 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:22
                                                              Start time:23:36:55
                                                              Start date:05/09/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=8128 --field-trial-handle=2076,i,16889548701178808674,4763158167382046842,262144 /prefetch:8
                                                              Imagebase:0x7ff6c1cf0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              Disassembly

                                                              Reset < >

                                                                Execution Graph

                                                                Execution Coverage:2%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:5%
                                                                Total number of Nodes:1430
                                                                Total number of Limit Nodes:37
                                                                execution_graph 94700 772e37 94779 77a961 94700->94779 94704 772e6b 94798 773a5a 94704->94798 94706 772e7f 94805 779cb3 94706->94805 94711 772ead 94833 77a8c7 22 API calls __fread_nolock 94711->94833 94712 7b2cb0 94851 7e2cf9 94712->94851 94714 7b2cc3 94716 7b2ccf 94714->94716 94877 774f39 94714->94877 94720 774f39 68 API calls 94716->94720 94717 772ec3 94834 776f88 22 API calls 94717->94834 94722 7b2ce5 94720->94722 94721 772ecf 94723 779cb3 22 API calls 94721->94723 94883 773084 22 API calls 94722->94883 94724 772edc 94723->94724 94835 77a81b 41 API calls 94724->94835 94727 772eec 94729 779cb3 22 API calls 94727->94729 94728 7b2d02 94884 773084 22 API calls 94728->94884 94731 772f12 94729->94731 94836 77a81b 41 API calls 94731->94836 94732 7b2d1e 94734 773a5a 24 API calls 94732->94734 94736 7b2d44 94734->94736 94735 772f21 94739 77a961 22 API calls 94735->94739 94885 773084 22 API calls 94736->94885 94738 7b2d50 94886 77a8c7 22 API calls __fread_nolock 94738->94886 94741 772f3f 94739->94741 94837 773084 22 API calls 94741->94837 94742 7b2d5e 94887 773084 22 API calls 94742->94887 94745 772f4b 94838 794a28 40 API calls 3 library calls 94745->94838 94746 7b2d6d 94888 77a8c7 22 API calls __fread_nolock 94746->94888 94748 772f59 94748->94722 94749 772f63 94748->94749 94839 794a28 40 API calls 3 library calls 94749->94839 94752 7b2d83 94889 773084 22 API calls 94752->94889 94753 772f6e 94753->94728 94755 772f78 94753->94755 94840 794a28 40 API calls 3 library calls 94755->94840 94756 7b2d90 94758 772f83 94758->94732 94759 772f8d 94758->94759 94841 794a28 40 API calls 3 library calls 94759->94841 94761 772f98 94762 772fdc 94761->94762 94842 773084 22 API calls 94761->94842 94762->94746 94763 772fe8 94762->94763 94763->94756 94845 7763eb 22 API calls 94763->94845 94765 772fbf 94843 77a8c7 22 API calls __fread_nolock 94765->94843 94767 772ff8 94846 776a50 22 API calls 94767->94846 94770 772fcd 94844 773084 22 API calls 94770->94844 94771 773006 94847 7770b0 23 API calls 94771->94847 94776 773021 94777 773065 94776->94777 94848 776f88 22 API calls 94776->94848 94849 7770b0 23 API calls 94776->94849 94850 773084 22 API calls 94776->94850 94890 78fe0b 94779->94890 94781 77a976 94900 78fddb 94781->94900 94783 772e4d 94784 774ae3 94783->94784 94785 774af0 __wsopen_s 94784->94785 94787 774b22 94785->94787 94928 776b57 94785->94928 94793 774b58 94787->94793 94925 774c6d 94787->94925 94789 779cb3 22 API calls 94791 774c52 94789->94791 94790 779cb3 22 API calls 94790->94793 94792 77515f 22 API calls 94791->94792 94795 774c5e 94792->94795 94793->94790 94796 774c29 94793->94796 94797 774c6d 22 API calls 94793->94797 94940 77515f 94793->94940 94795->94704 94796->94789 94796->94795 94797->94793 94957 7b1f50 94798->94957 94801 779cb3 22 API calls 94802 773a8d 94801->94802 94959 773aa2 94802->94959 94804 773a97 94804->94706 94806 779cc2 _wcslen 94805->94806 94807 78fe0b 22 API calls 94806->94807 94808 779cea __fread_nolock 94807->94808 94809 78fddb 22 API calls 94808->94809 94810 772e8c 94809->94810 94811 774ecb 94810->94811 94979 774e90 LoadLibraryA 94811->94979 94816 774ef6 LoadLibraryExW 94987 774e59 LoadLibraryA 94816->94987 94817 7b3ccf 94818 774f39 68 API calls 94817->94818 94820 7b3cd6 94818->94820 94822 774e59 3 API calls 94820->94822 94824 7b3cde 94822->94824 95009 7750f5 94824->95009 94825 774f20 94825->94824 94826 774f2c 94825->94826 94828 774f39 68 API calls 94826->94828 94830 772ea5 94828->94830 94830->94711 94830->94712 94832 7b3d05 94833->94717 94834->94721 94835->94727 94836->94735 94837->94745 94838->94748 94839->94753 94840->94758 94841->94761 94842->94765 94843->94770 94844->94762 94845->94767 94846->94771 94847->94776 94848->94776 94849->94776 94850->94776 94852 7e2d15 94851->94852 94853 77511f 64 API calls 94852->94853 94854 7e2d29 94853->94854 95159 7e2e66 94854->95159 94857 7750f5 40 API calls 94858 7e2d56 94857->94858 94859 7750f5 40 API calls 94858->94859 94860 7e2d66 94859->94860 94861 7750f5 40 API calls 94860->94861 94862 7e2d81 94861->94862 94863 7750f5 40 API calls 94862->94863 94864 7e2d9c 94863->94864 94865 77511f 64 API calls 94864->94865 94866 7e2db3 94865->94866 94867 79ea0c ___std_exception_copy 21 API calls 94866->94867 94868 7e2dba 94867->94868 94869 79ea0c ___std_exception_copy 21 API calls 94868->94869 94870 7e2dc4 94869->94870 94871 7750f5 40 API calls 94870->94871 94872 7e2dd8 94871->94872 94873 7e28fe 27 API calls 94872->94873 94875 7e2dee 94873->94875 94874 7e2d3f 94874->94714 94875->94874 95165 7e22ce 79 API calls 94875->95165 94878 774f43 94877->94878 94880 774f4a 94877->94880 95166 79e678 94878->95166 94881 774f6a FreeLibrary 94880->94881 94882 774f59 94880->94882 94881->94882 94882->94716 94883->94728 94884->94732 94885->94738 94886->94742 94887->94746 94888->94752 94889->94756 94893 78fddb 94890->94893 94892 78fdfa 94892->94781 94893->94892 94896 78fdfc 94893->94896 94910 79ea0c 94893->94910 94917 794ead 7 API calls 2 library calls 94893->94917 94895 79066d 94919 7932a4 RaiseException 94895->94919 94896->94895 94918 7932a4 RaiseException 94896->94918 94899 79068a 94899->94781 94903 78fde0 94900->94903 94901 79ea0c ___std_exception_copy 21 API calls 94901->94903 94902 78fdfa 94902->94783 94903->94901 94903->94902 94905 78fdfc 94903->94905 94922 794ead 7 API calls 2 library calls 94903->94922 94906 79066d 94905->94906 94923 7932a4 RaiseException 94905->94923 94924 7932a4 RaiseException 94906->94924 94908 79068a 94908->94783 94915 7a3820 __dosmaperr 94910->94915 94911 7a385e 94921 79f2d9 20 API calls __dosmaperr 94911->94921 94912 7a3849 RtlAllocateHeap 94914 7a385c 94912->94914 94912->94915 94914->94893 94915->94911 94915->94912 94920 794ead 7 API calls 2 library calls 94915->94920 94917->94893 94918->94895 94919->94899 94920->94915 94921->94914 94922->94903 94923->94906 94924->94908 94946 77aec9 94925->94946 94927 774c78 94927->94787 94929 776b67 _wcslen 94928->94929 94930 7b4ba1 94928->94930 94933 776ba2 94929->94933 94934 776b7d 94929->94934 94953 7793b2 94930->94953 94932 7b4baa 94932->94932 94936 78fddb 22 API calls 94933->94936 94952 776f34 22 API calls 94934->94952 94937 776bae 94936->94937 94939 78fe0b 22 API calls 94937->94939 94938 776b85 __fread_nolock 94938->94787 94939->94938 94941 77516e 94940->94941 94945 77518f __fread_nolock 94940->94945 94943 78fe0b 22 API calls 94941->94943 94942 78fddb 22 API calls 94944 7751a2 94942->94944 94943->94945 94944->94793 94945->94942 94947 77aedc 94946->94947 94948 77aed9 __fread_nolock 94946->94948 94949 78fddb 22 API calls 94947->94949 94948->94927 94950 77aee7 94949->94950 94951 78fe0b 22 API calls 94950->94951 94951->94948 94952->94938 94954 7793c0 94953->94954 94955 7793c9 __fread_nolock 94953->94955 94954->94955 94956 77aec9 22 API calls 94954->94956 94955->94932 94956->94955 94958 773a67 GetModuleFileNameW 94957->94958 94958->94801 94960 7b1f50 __wsopen_s 94959->94960 94961 773aaf GetFullPathNameW 94960->94961 94962 773ace 94961->94962 94963 773ae9 94961->94963 94965 776b57 22 API calls 94962->94965 94973 77a6c3 94963->94973 94966 773ada 94965->94966 94969 7737a0 94966->94969 94970 7737ae 94969->94970 94971 7793b2 22 API calls 94970->94971 94972 7737c2 94971->94972 94972->94804 94974 77a6dd 94973->94974 94978 77a6d0 94973->94978 94975 78fddb 22 API calls 94974->94975 94976 77a6e7 94975->94976 94977 78fe0b 22 API calls 94976->94977 94977->94978 94978->94966 94980 774ec6 94979->94980 94981 774ea8 GetProcAddress 94979->94981 94984 79e5eb 94980->94984 94982 774eb8 94981->94982 94982->94980 94983 774ebf FreeLibrary 94982->94983 94983->94980 95017 79e52a 94984->95017 94986 774eea 94986->94816 94986->94817 94988 774e6e GetProcAddress 94987->94988 94989 774e8d 94987->94989 94990 774e7e 94988->94990 94992 774f80 94989->94992 94990->94989 94991 774e86 FreeLibrary 94990->94991 94991->94989 94993 78fe0b 22 API calls 94992->94993 94994 774f95 94993->94994 95085 775722 94994->95085 94996 774fa1 __fread_nolock 94997 7750a5 94996->94997 94998 7b3d1d 94996->94998 95008 774fdc 94996->95008 95088 7742a2 CreateStreamOnHGlobal 94997->95088 95099 7e304d 74 API calls 94998->95099 95001 7b3d22 95003 77511f 64 API calls 95001->95003 95002 7750f5 40 API calls 95002->95008 95004 7b3d45 95003->95004 95005 7750f5 40 API calls 95004->95005 95007 77506e messages 95005->95007 95007->94825 95008->95001 95008->95002 95008->95007 95094 77511f 95008->95094 95010 775107 95009->95010 95011 7b3d70 95009->95011 95121 79e8c4 95010->95121 95014 7e28fe 95142 7e274e 95014->95142 95016 7e2919 95016->94832 95020 79e536 ___BuildCatchObject 95017->95020 95018 79e544 95042 79f2d9 20 API calls __dosmaperr 95018->95042 95020->95018 95022 79e574 95020->95022 95021 79e549 95043 7a27ec 26 API calls __cftof 95021->95043 95024 79e579 95022->95024 95025 79e586 95022->95025 95044 79f2d9 20 API calls __dosmaperr 95024->95044 95034 7a8061 95025->95034 95028 79e58f 95029 79e5a2 95028->95029 95030 79e595 95028->95030 95046 79e5d4 LeaveCriticalSection __fread_nolock 95029->95046 95045 79f2d9 20 API calls __dosmaperr 95030->95045 95032 79e554 __wsopen_s 95032->94986 95035 7a806d ___BuildCatchObject 95034->95035 95047 7a2f5e EnterCriticalSection 95035->95047 95037 7a807b 95048 7a80fb 95037->95048 95041 7a80ac __wsopen_s 95041->95028 95042->95021 95043->95032 95044->95032 95045->95032 95046->95032 95047->95037 95049 7a811e 95048->95049 95050 7a8177 95049->95050 95057 7a8088 95049->95057 95064 79918d EnterCriticalSection 95049->95064 95065 7991a1 LeaveCriticalSection 95049->95065 95066 7a4c7d 95050->95066 95055 7a8189 95055->95057 95079 7a3405 11 API calls 2 library calls 95055->95079 95061 7a80b7 95057->95061 95058 7a81a8 95080 79918d EnterCriticalSection 95058->95080 95084 7a2fa6 LeaveCriticalSection 95061->95084 95063 7a80be 95063->95041 95064->95049 95065->95049 95071 7a4c8a __dosmaperr 95066->95071 95067 7a4cca 95082 79f2d9 20 API calls __dosmaperr 95067->95082 95068 7a4cb5 RtlAllocateHeap 95069 7a4cc8 95068->95069 95068->95071 95073 7a29c8 95069->95073 95071->95067 95071->95068 95081 794ead 7 API calls 2 library calls 95071->95081 95074 7a29d3 RtlFreeHeap 95073->95074 95075 7a29fc _free 95073->95075 95074->95075 95076 7a29e8 95074->95076 95075->95055 95083 79f2d9 20 API calls __dosmaperr 95076->95083 95078 7a29ee GetLastError 95078->95075 95079->95058 95080->95057 95081->95071 95082->95069 95083->95078 95084->95063 95086 78fddb 22 API calls 95085->95086 95087 775734 95086->95087 95087->94996 95089 7742bc FindResourceExW 95088->95089 95093 7742d9 95088->95093 95090 7b35ba LoadResource 95089->95090 95089->95093 95091 7b35cf SizeofResource 95090->95091 95090->95093 95092 7b35e3 LockResource 95091->95092 95091->95093 95092->95093 95093->95008 95095 77512e 95094->95095 95098 7b3d90 95094->95098 95100 79ece3 95095->95100 95099->95001 95103 79eaaa 95100->95103 95102 77513c 95102->95008 95107 79eab6 ___BuildCatchObject 95103->95107 95104 79eac2 95116 79f2d9 20 API calls __dosmaperr 95104->95116 95106 79eae8 95118 79918d EnterCriticalSection 95106->95118 95107->95104 95107->95106 95109 79eac7 95117 7a27ec 26 API calls __cftof 95109->95117 95110 79eaf4 95119 79ec0a 62 API calls 2 library calls 95110->95119 95113 79eb08 95120 79eb27 LeaveCriticalSection __fread_nolock 95113->95120 95115 79ead2 __wsopen_s 95115->95102 95116->95109 95117->95115 95118->95110 95119->95113 95120->95115 95124 79e8e1 95121->95124 95123 775118 95123->95014 95125 79e8ed ___BuildCatchObject 95124->95125 95126 79e925 __wsopen_s 95125->95126 95127 79e92d 95125->95127 95128 79e900 ___scrt_fastfail 95125->95128 95126->95123 95139 79918d EnterCriticalSection 95127->95139 95137 79f2d9 20 API calls __dosmaperr 95128->95137 95130 79e937 95140 79e6f8 38 API calls 4 library calls 95130->95140 95133 79e91a 95138 7a27ec 26 API calls __cftof 95133->95138 95134 79e94e 95141 79e96c LeaveCriticalSection __fread_nolock 95134->95141 95137->95133 95138->95126 95139->95130 95140->95134 95141->95126 95145 79e4e8 95142->95145 95144 7e275d 95144->95016 95148 79e469 95145->95148 95147 79e505 95147->95144 95149 79e478 95148->95149 95150 79e48c 95148->95150 95156 79f2d9 20 API calls __dosmaperr 95149->95156 95155 79e488 __alldvrm 95150->95155 95158 7a333f 11 API calls 2 library calls 95150->95158 95153 79e47d 95157 7a27ec 26 API calls __cftof 95153->95157 95155->95147 95156->95153 95157->95155 95158->95155 95162 7e2e7a 95159->95162 95160 7750f5 40 API calls 95160->95162 95161 7e28fe 27 API calls 95161->95162 95162->95160 95162->95161 95163 7e2d3b 95162->95163 95164 77511f 64 API calls 95162->95164 95163->94857 95163->94874 95164->95162 95165->94874 95167 79e684 ___BuildCatchObject 95166->95167 95168 79e6aa 95167->95168 95169 79e695 95167->95169 95178 79e6a5 __wsopen_s 95168->95178 95179 79918d EnterCriticalSection 95168->95179 95196 79f2d9 20 API calls __dosmaperr 95169->95196 95172 79e69a 95197 7a27ec 26 API calls __cftof 95172->95197 95173 79e6c6 95180 79e602 95173->95180 95176 79e6d1 95198 79e6ee LeaveCriticalSection __fread_nolock 95176->95198 95178->94880 95179->95173 95181 79e60f 95180->95181 95182 79e624 95180->95182 95231 79f2d9 20 API calls __dosmaperr 95181->95231 95189 79e61f 95182->95189 95199 79dc0b 95182->95199 95184 79e614 95232 7a27ec 26 API calls __cftof 95184->95232 95189->95176 95192 79e646 95216 7a862f 95192->95216 95195 7a29c8 _free 20 API calls 95195->95189 95196->95172 95197->95178 95198->95178 95200 79dc23 95199->95200 95202 79dc1f 95199->95202 95201 79d955 __fread_nolock 26 API calls 95200->95201 95200->95202 95203 79dc43 95201->95203 95205 7a4d7a 95202->95205 95233 7a59be 62 API calls 5 library calls 95203->95233 95206 7a4d90 95205->95206 95207 79e640 95205->95207 95206->95207 95208 7a29c8 _free 20 API calls 95206->95208 95209 79d955 95207->95209 95208->95207 95210 79d961 95209->95210 95211 79d976 95209->95211 95234 79f2d9 20 API calls __dosmaperr 95210->95234 95211->95192 95213 79d966 95235 7a27ec 26 API calls __cftof 95213->95235 95215 79d971 95215->95192 95217 7a863e 95216->95217 95218 7a8653 95216->95218 95239 79f2c6 20 API calls __dosmaperr 95217->95239 95219 7a868e 95218->95219 95223 7a867a 95218->95223 95241 79f2c6 20 API calls __dosmaperr 95219->95241 95222 7a8643 95240 79f2d9 20 API calls __dosmaperr 95222->95240 95236 7a8607 95223->95236 95224 7a8693 95242 79f2d9 20 API calls __dosmaperr 95224->95242 95228 79e64c 95228->95189 95228->95195 95229 7a869b 95243 7a27ec 26 API calls __cftof 95229->95243 95231->95184 95232->95189 95233->95202 95234->95213 95235->95215 95244 7a8585 95236->95244 95238 7a862b 95238->95228 95239->95222 95240->95228 95241->95224 95242->95229 95243->95228 95245 7a8591 ___BuildCatchObject 95244->95245 95255 7a5147 EnterCriticalSection 95245->95255 95247 7a859f 95248 7a85d1 95247->95248 95249 7a85c6 95247->95249 95271 79f2d9 20 API calls __dosmaperr 95248->95271 95256 7a86ae 95249->95256 95252 7a85cc 95272 7a85fb LeaveCriticalSection __wsopen_s 95252->95272 95254 7a85ee __wsopen_s 95254->95238 95255->95247 95273 7a53c4 95256->95273 95258 7a86c4 95286 7a5333 21 API calls 3 library calls 95258->95286 95260 7a86be 95260->95258 95261 7a86f6 95260->95261 95263 7a53c4 __wsopen_s 26 API calls 95260->95263 95261->95258 95264 7a53c4 __wsopen_s 26 API calls 95261->95264 95262 7a871c 95265 7a873e 95262->95265 95287 79f2a3 20 API calls 2 library calls 95262->95287 95266 7a86ed 95263->95266 95267 7a8702 FindCloseChangeNotification 95264->95267 95265->95252 95269 7a53c4 __wsopen_s 26 API calls 95266->95269 95267->95258 95270 7a870e GetLastError 95267->95270 95269->95261 95270->95258 95271->95252 95272->95254 95274 7a53d1 95273->95274 95275 7a53e6 95273->95275 95288 79f2c6 20 API calls __dosmaperr 95274->95288 95280 7a540b 95275->95280 95290 79f2c6 20 API calls __dosmaperr 95275->95290 95277 7a53d6 95289 79f2d9 20 API calls __dosmaperr 95277->95289 95280->95260 95281 7a5416 95291 79f2d9 20 API calls __dosmaperr 95281->95291 95282 7a53de 95282->95260 95284 7a541e 95292 7a27ec 26 API calls __cftof 95284->95292 95286->95262 95287->95265 95288->95277 95289->95282 95290->95281 95291->95284 95292->95282 95293 773156 95296 773170 95293->95296 95297 773187 95296->95297 95298 77318c 95297->95298 95299 7731eb 95297->95299 95336 7731e9 95297->95336 95303 773265 PostQuitMessage 95298->95303 95304 773199 95298->95304 95301 7b2dfb 95299->95301 95302 7731f1 95299->95302 95300 7731d0 DefWindowProcW 95338 77316a 95300->95338 95348 7718e2 10 API calls 95301->95348 95305 77321d SetTimer RegisterWindowMessageW 95302->95305 95306 7731f8 95302->95306 95303->95338 95308 7731a4 95304->95308 95309 7b2e7c 95304->95309 95313 773246 CreatePopupMenu 95305->95313 95305->95338 95310 773201 KillTimer 95306->95310 95311 7b2d9c 95306->95311 95314 7b2e68 95308->95314 95315 7731ae 95308->95315 95362 7dbf30 34 API calls ___scrt_fastfail 95309->95362 95341 7730f2 95310->95341 95317 7b2da1 95311->95317 95318 7b2dd7 MoveWindow 95311->95318 95312 7b2e1c 95349 78e499 42 API calls 95312->95349 95313->95338 95361 7dc161 27 API calls ___scrt_fastfail 95314->95361 95322 7b2e4d 95315->95322 95323 7731b9 95315->95323 95325 7b2da7 95317->95325 95326 7b2dc6 SetFocus 95317->95326 95318->95338 95322->95300 95360 7d0ad7 22 API calls 95322->95360 95328 773253 95323->95328 95329 7731c4 95323->95329 95324 7b2e8e 95324->95300 95324->95338 95325->95329 95330 7b2db0 95325->95330 95326->95338 95346 77326f 44 API calls ___scrt_fastfail 95328->95346 95329->95300 95337 7730f2 Shell_NotifyIconW 95329->95337 95347 7718e2 10 API calls 95330->95347 95334 773263 95334->95338 95336->95300 95339 7b2e41 95337->95339 95350 773837 95339->95350 95342 773154 95341->95342 95343 773104 ___scrt_fastfail 95341->95343 95345 773c50 DeleteObject DestroyWindow 95342->95345 95344 773123 Shell_NotifyIconW 95343->95344 95344->95342 95345->95338 95346->95334 95347->95338 95348->95312 95349->95329 95351 773862 ___scrt_fastfail 95350->95351 95363 774212 95351->95363 95354 7738e8 95356 773906 Shell_NotifyIconW 95354->95356 95357 7b3386 Shell_NotifyIconW 95354->95357 95367 773923 95356->95367 95359 77391c 95359->95336 95360->95336 95361->95334 95362->95324 95364 7738b7 95363->95364 95365 7b35a4 95363->95365 95364->95354 95389 7dc874 42 API calls _strftime 95364->95389 95365->95364 95366 7b35ad DestroyIcon 95365->95366 95366->95364 95368 773a13 95367->95368 95369 77393f 95367->95369 95368->95359 95390 776270 95369->95390 95372 7b3393 LoadStringW 95375 7b33ad 95372->95375 95373 77395a 95374 776b57 22 API calls 95373->95374 95376 77396f 95374->95376 95383 773994 ___scrt_fastfail 95375->95383 95396 77a8c7 22 API calls __fread_nolock 95375->95396 95377 7b33c9 95376->95377 95378 77397c 95376->95378 95397 776350 22 API calls 95377->95397 95378->95375 95380 773986 95378->95380 95395 776350 22 API calls 95380->95395 95386 7739f9 Shell_NotifyIconW 95383->95386 95384 7b33d7 95384->95383 95398 7733c6 95384->95398 95386->95368 95387 7b33f9 95388 7733c6 22 API calls 95387->95388 95388->95383 95389->95354 95391 78fe0b 22 API calls 95390->95391 95392 776295 95391->95392 95393 78fddb 22 API calls 95392->95393 95394 77394d 95393->95394 95394->95372 95394->95373 95395->95383 95396->95383 95397->95384 95399 7b30bb 95398->95399 95400 7733dd 95398->95400 95402 78fddb 22 API calls 95399->95402 95407 7733ee 95400->95407 95404 7b30c5 _wcslen 95402->95404 95403 7733e8 95403->95387 95405 78fe0b 22 API calls 95404->95405 95406 7b30fe __fread_nolock 95405->95406 95408 7733fe _wcslen 95407->95408 95409 7b311d 95408->95409 95410 773411 95408->95410 95412 78fddb 22 API calls 95409->95412 95417 77a587 95410->95417 95414 7b3127 95412->95414 95413 77341e __fread_nolock 95413->95403 95415 78fe0b 22 API calls 95414->95415 95416 7b3157 __fread_nolock 95415->95416 95418 77a59d 95417->95418 95421 77a598 __fread_nolock 95417->95421 95419 7bf80f 95418->95419 95420 78fe0b 22 API calls 95418->95420 95420->95421 95421->95413 95422 7903fb 95423 790407 ___BuildCatchObject 95422->95423 95451 78feb1 95423->95451 95425 79040e 95426 790561 95425->95426 95429 790438 95425->95429 95481 79083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 95426->95481 95428 790568 95474 794e52 95428->95474 95440 790477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 95429->95440 95462 7a247d 95429->95462 95436 790457 95438 7904d8 95470 790959 95438->95470 95440->95438 95477 794e1a 38 API calls 3 library calls 95440->95477 95442 7904de 95443 7904f3 95442->95443 95478 790992 GetModuleHandleW 95443->95478 95445 7904fa 95445->95428 95446 7904fe 95445->95446 95447 790507 95446->95447 95479 794df5 28 API calls _abort 95446->95479 95480 790040 13 API calls 2 library calls 95447->95480 95450 79050f 95450->95436 95452 78feba 95451->95452 95483 790698 IsProcessorFeaturePresent 95452->95483 95454 78fec6 95484 792c94 10 API calls 3 library calls 95454->95484 95456 78fecf 95456->95425 95457 78fecb 95457->95456 95485 7a2317 95457->95485 95460 78fee6 95460->95425 95463 7a2494 95462->95463 95464 790a8c _ValidateLocalCookies 5 API calls 95463->95464 95465 790451 95464->95465 95465->95436 95466 7a2421 95465->95466 95468 7a2450 95466->95468 95467 790a8c _ValidateLocalCookies 5 API calls 95469 7a2479 95467->95469 95468->95467 95469->95440 95544 792340 95470->95544 95472 79096c GetStartupInfoW 95473 79097f 95472->95473 95473->95442 95546 794bcf 95474->95546 95477->95438 95478->95445 95479->95447 95480->95450 95481->95428 95483->95454 95484->95457 95489 7ad1f6 95485->95489 95488 792cbd 8 API calls 3 library calls 95488->95456 95492 7ad213 95489->95492 95493 7ad20f 95489->95493 95491 78fed8 95491->95460 95491->95488 95492->95493 95495 7a4bfb 95492->95495 95507 790a8c 95493->95507 95496 7a4c07 ___BuildCatchObject 95495->95496 95514 7a2f5e EnterCriticalSection 95496->95514 95498 7a4c0e 95515 7a50af 95498->95515 95500 7a4c1d 95501 7a4c2c 95500->95501 95528 7a4a8f 29 API calls 95500->95528 95530 7a4c48 LeaveCriticalSection _abort 95501->95530 95504 7a4c27 95529 7a4b45 GetStdHandle GetFileType 95504->95529 95505 7a4c3d __wsopen_s 95505->95492 95508 790a95 95507->95508 95509 790a97 IsProcessorFeaturePresent 95507->95509 95508->95491 95511 790c5d 95509->95511 95543 790c21 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 95511->95543 95513 790d40 95513->95491 95514->95498 95516 7a50bb ___BuildCatchObject 95515->95516 95517 7a50c8 95516->95517 95518 7a50df 95516->95518 95539 79f2d9 20 API calls __dosmaperr 95517->95539 95531 7a2f5e EnterCriticalSection 95518->95531 95521 7a50cd 95540 7a27ec 26 API calls __cftof 95521->95540 95523 7a50eb 95527 7a5117 95523->95527 95532 7a5000 95523->95532 95526 7a50d7 __wsopen_s 95526->95500 95541 7a513e LeaveCriticalSection _abort 95527->95541 95528->95504 95529->95501 95530->95505 95531->95523 95533 7a4c7d __dosmaperr 20 API calls 95532->95533 95534 7a5012 95533->95534 95538 7a501f 95534->95538 95542 7a3405 11 API calls 2 library calls 95534->95542 95535 7a29c8 _free 20 API calls 95537 7a5071 95535->95537 95537->95523 95538->95535 95539->95521 95540->95526 95541->95526 95542->95534 95543->95513 95545 792357 95544->95545 95545->95472 95545->95545 95547 794bdb FindHandlerForForeignException 95546->95547 95548 794be2 95547->95548 95549 794bf4 95547->95549 95585 794d29 GetModuleHandleW 95548->95585 95570 7a2f5e EnterCriticalSection 95549->95570 95552 794be7 95552->95549 95586 794d6d GetModuleHandleExW 95552->95586 95557 794bfb 95565 794c70 95557->95565 95568 794c99 95557->95568 95571 7a21a8 95557->95571 95558 794ce2 95594 7b1d29 5 API calls _ValidateLocalCookies 95558->95594 95559 794cb6 95577 794ce8 95559->95577 95561 7a2421 _abort 5 API calls 95567 794c88 95561->95567 95562 7a2421 _abort 5 API calls 95562->95568 95565->95561 95565->95567 95567->95562 95574 794cd9 95568->95574 95570->95557 95595 7a1ee1 95571->95595 95614 7a2fa6 LeaveCriticalSection 95574->95614 95576 794cb2 95576->95558 95576->95559 95615 7a360c 95577->95615 95580 794d16 95583 794d6d _abort 8 API calls 95580->95583 95581 794cf6 GetPEB 95581->95580 95582 794d06 GetCurrentProcess TerminateProcess 95581->95582 95582->95580 95584 794d1e ExitProcess 95583->95584 95585->95552 95587 794dba 95586->95587 95588 794d97 GetProcAddress 95586->95588 95589 794dc9 95587->95589 95590 794dc0 FreeLibrary 95587->95590 95591 794dac 95588->95591 95592 790a8c _ValidateLocalCookies 5 API calls 95589->95592 95590->95589 95591->95587 95593 794bf3 95592->95593 95593->95549 95598 7a1e90 95595->95598 95597 7a1f05 95597->95565 95599 7a1e9c ___BuildCatchObject 95598->95599 95606 7a2f5e EnterCriticalSection 95599->95606 95601 7a1eaa 95607 7a1f31 95601->95607 95605 7a1ec8 __wsopen_s 95605->95597 95606->95601 95610 7a1f59 95607->95610 95612 7a1f51 95607->95612 95608 790a8c _ValidateLocalCookies 5 API calls 95609 7a1eb7 95608->95609 95613 7a1ed5 LeaveCriticalSection _abort 95609->95613 95611 7a29c8 _free 20 API calls 95610->95611 95610->95612 95611->95612 95612->95608 95613->95605 95614->95576 95616 7a3631 95615->95616 95617 7a3627 95615->95617 95622 7a2fd7 5 API calls 2 library calls 95616->95622 95619 790a8c _ValidateLocalCookies 5 API calls 95617->95619 95621 794cf2 95619->95621 95620 7a3648 95620->95617 95621->95580 95621->95581 95622->95620 95623 771033 95628 774c91 95623->95628 95627 771042 95629 77a961 22 API calls 95628->95629 95630 774cff 95629->95630 95636 773af0 95630->95636 95633 774d9c 95634 771038 95633->95634 95639 7751f7 22 API calls __fread_nolock 95633->95639 95635 7900a3 29 API calls __onexit 95634->95635 95635->95627 95640 773b1c 95636->95640 95639->95633 95641 773b0f 95640->95641 95642 773b29 95640->95642 95641->95633 95642->95641 95643 773b30 RegOpenKeyExW 95642->95643 95643->95641 95644 773b4a RegQueryValueExW 95643->95644 95645 773b80 RegCloseKey 95644->95645 95646 773b6b 95644->95646 95645->95641 95646->95645 95647 77f7bf 95648 77fcb6 95647->95648 95649 77f7d3 95647->95649 95738 77aceb 23 API calls messages 95648->95738 95651 77fcc2 95649->95651 95652 78fddb 22 API calls 95649->95652 95739 77aceb 23 API calls messages 95651->95739 95654 77f7e5 95652->95654 95654->95651 95655 77f83e 95654->95655 95656 77fd3d 95654->95656 95680 77ed9d messages 95655->95680 95682 781310 95655->95682 95740 7e1155 22 API calls 95656->95740 95660 77fef7 95660->95680 95742 77a8c7 22 API calls __fread_nolock 95660->95742 95662 7c4600 95662->95680 95741 77a8c7 22 API calls __fread_nolock 95662->95741 95663 7c4b0b 95744 7e359c 82 API calls __wsopen_s 95663->95744 95664 77a8c7 22 API calls 95679 77ec76 messages 95664->95679 95670 790242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95670->95679 95671 77fbe3 95673 7c4bdc 95671->95673 95671->95680 95681 77f3ae messages 95671->95681 95672 77a961 22 API calls 95672->95679 95745 7e359c 82 API calls __wsopen_s 95673->95745 95674 7900a3 29 API calls pre_c_initialization 95674->95679 95676 7c4beb 95746 7e359c 82 API calls __wsopen_s 95676->95746 95677 7901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 95677->95679 95678 78fddb 22 API calls 95678->95679 95679->95660 95679->95662 95679->95663 95679->95664 95679->95670 95679->95671 95679->95672 95679->95674 95679->95676 95679->95677 95679->95678 95679->95680 95679->95681 95736 7801e0 185 API calls 2 library calls 95679->95736 95737 7806a0 41 API calls messages 95679->95737 95681->95680 95743 7e359c 82 API calls __wsopen_s 95681->95743 95683 7817b0 95682->95683 95684 781376 95682->95684 95795 790242 5 API calls __Init_thread_wait 95683->95795 95685 781390 95684->95685 95686 7c6331 95684->95686 95747 781940 95685->95747 95800 7f709c 185 API calls 95686->95800 95690 7817ba 95693 7817fb 95690->95693 95695 779cb3 22 API calls 95690->95695 95692 7c633d 95692->95679 95697 7c6346 95693->95697 95699 78182c 95693->95699 95694 781940 9 API calls 95696 7813b6 95694->95696 95702 7817d4 95695->95702 95696->95693 95698 7813ec 95696->95698 95801 7e359c 82 API calls __wsopen_s 95697->95801 95698->95697 95722 781408 __fread_nolock 95698->95722 95797 77aceb 23 API calls messages 95699->95797 95796 7901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95702->95796 95703 781839 95798 78d217 185 API calls 95703->95798 95706 7c636e 95802 7e359c 82 API calls __wsopen_s 95706->95802 95707 78152f 95709 78153c 95707->95709 95710 7c63d1 95707->95710 95712 781940 9 API calls 95709->95712 95804 7f5745 54 API calls _wcslen 95710->95804 95713 781549 95712->95713 95717 7c64fa 95713->95717 95719 781940 9 API calls 95713->95719 95714 78fddb 22 API calls 95714->95722 95715 781872 95799 78faeb 23 API calls 95715->95799 95716 78fe0b 22 API calls 95716->95722 95726 7c6369 95717->95726 95806 7e359c 82 API calls __wsopen_s 95717->95806 95724 781563 95719->95724 95722->95703 95722->95706 95722->95707 95722->95714 95722->95716 95723 7c63b2 95722->95723 95722->95726 95770 77ec40 95722->95770 95803 7e359c 82 API calls __wsopen_s 95723->95803 95724->95717 95729 7815c7 messages 95724->95729 95805 77a8c7 22 API calls __fread_nolock 95724->95805 95726->95679 95728 781940 9 API calls 95728->95729 95729->95715 95729->95717 95729->95726 95729->95728 95731 78167b messages 95729->95731 95757 7fac5b 95729->95757 95760 7fa2ea 95729->95760 95765 7e5c5a 95729->95765 95730 78171d 95730->95679 95731->95730 95794 78ce17 22 API calls messages 95731->95794 95736->95679 95737->95679 95738->95651 95739->95656 95740->95680 95741->95680 95742->95680 95743->95680 95744->95680 95745->95676 95746->95680 95748 781981 95747->95748 95750 78195d 95747->95750 95807 790242 5 API calls __Init_thread_wait 95748->95807 95751 7813a0 95750->95751 95809 790242 5 API calls __Init_thread_wait 95750->95809 95751->95694 95752 78198b 95752->95750 95808 7901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95752->95808 95754 788727 95754->95751 95810 7901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95754->95810 95811 7fad64 95757->95811 95759 7fac6f 95759->95729 95761 777510 53 API calls 95760->95761 95762 7fa306 95761->95762 95870 7dd4dc CreateToolhelp32Snapshot Process32FirstW 95762->95870 95764 7fa315 95764->95729 95766 777510 53 API calls 95765->95766 95767 7e5c6d 95766->95767 95891 7ddbbe lstrlenW 95767->95891 95769 7e5c77 95769->95729 95788 77ec76 messages 95770->95788 95771 790242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95771->95788 95773 77fef7 95786 77ed9d messages 95773->95786 95899 77a8c7 22 API calls __fread_nolock 95773->95899 95775 78fddb 22 API calls 95775->95788 95776 7c4600 95776->95786 95898 77a8c7 22 API calls __fread_nolock 95776->95898 95777 7c4b0b 95901 7e359c 82 API calls __wsopen_s 95777->95901 95781 77a8c7 22 API calls 95781->95788 95784 77fbe3 95784->95786 95787 7c4bdc 95784->95787 95793 77f3ae messages 95784->95793 95785 77a961 22 API calls 95785->95788 95786->95722 95902 7e359c 82 API calls __wsopen_s 95787->95902 95788->95771 95788->95773 95788->95775 95788->95776 95788->95777 95788->95781 95788->95784 95788->95785 95788->95786 95789 7900a3 29 API calls pre_c_initialization 95788->95789 95791 7c4beb 95788->95791 95792 7901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 95788->95792 95788->95793 95896 7801e0 185 API calls 2 library calls 95788->95896 95897 7806a0 41 API calls messages 95788->95897 95789->95788 95903 7e359c 82 API calls __wsopen_s 95791->95903 95792->95788 95793->95786 95900 7e359c 82 API calls __wsopen_s 95793->95900 95794->95731 95795->95690 95796->95693 95797->95703 95798->95715 95799->95715 95800->95692 95801->95726 95802->95726 95803->95726 95804->95724 95805->95729 95806->95726 95807->95752 95808->95750 95809->95754 95810->95751 95812 77a961 22 API calls 95811->95812 95813 7fad77 ___scrt_fastfail 95812->95813 95814 7fadce 95813->95814 95816 777510 53 API calls 95813->95816 95815 7fadee 95814->95815 95817 777510 53 API calls 95814->95817 95818 7fae3a 95815->95818 95821 777510 53 API calls 95815->95821 95819 7fadab 95816->95819 95820 7fade4 95817->95820 95824 7fae4d ___scrt_fastfail 95818->95824 95865 77b567 39 API calls 95818->95865 95819->95814 95822 777510 53 API calls 95819->95822 95863 777620 22 API calls _wcslen 95820->95863 95829 7fae04 95821->95829 95825 7fadc4 95822->95825 95839 777510 95824->95839 95862 777620 22 API calls _wcslen 95825->95862 95829->95818 95831 777510 53 API calls 95829->95831 95832 7fae28 95831->95832 95832->95818 95864 77a8c7 22 API calls __fread_nolock 95832->95864 95833 7faeb0 95835 7faec8 95833->95835 95836 7faf35 GetProcessId 95833->95836 95835->95759 95837 7faf48 95836->95837 95838 7faf58 CloseHandle 95837->95838 95838->95835 95840 777525 95839->95840 95841 777522 ShellExecuteExW 95839->95841 95842 77752d 95840->95842 95843 77755b 95840->95843 95841->95833 95866 7951c6 26 API calls 95842->95866 95844 7b50f6 95843->95844 95846 77756d 95843->95846 95853 7b500f 95843->95853 95869 795183 26 API calls 95844->95869 95867 78fb21 51 API calls 95846->95867 95847 77753d 95852 78fddb 22 API calls 95847->95852 95850 7b510e 95850->95850 95854 777547 95852->95854 95855 7b5088 95853->95855 95857 78fe0b 22 API calls 95853->95857 95856 779cb3 22 API calls 95854->95856 95868 78fb21 51 API calls 95855->95868 95856->95841 95858 7b5058 95857->95858 95859 78fddb 22 API calls 95858->95859 95860 7b507f 95859->95860 95861 779cb3 22 API calls 95860->95861 95861->95855 95862->95814 95863->95815 95864->95818 95865->95824 95866->95847 95867->95847 95868->95844 95869->95850 95880 7ddef7 95870->95880 95872 7dd529 Process32NextW 95873 7dd5db FindCloseChangeNotification 95872->95873 95879 7dd522 95872->95879 95873->95764 95874 77a961 22 API calls 95874->95879 95875 779cb3 22 API calls 95875->95879 95879->95872 95879->95873 95879->95874 95879->95875 95886 77525f 22 API calls 95879->95886 95887 776350 22 API calls 95879->95887 95888 78ce60 41 API calls 95879->95888 95885 7ddf02 95880->95885 95881 7ddf19 95890 7962fb 39 API calls _strftime 95881->95890 95884 7ddf1f 95884->95879 95885->95881 95885->95884 95889 7963b2 GetStringTypeW _strftime 95885->95889 95886->95879 95887->95879 95888->95879 95889->95885 95890->95884 95892 7ddbdc GetFileAttributesW 95891->95892 95893 7ddc06 95891->95893 95892->95893 95894 7ddbe8 FindFirstFileW 95892->95894 95893->95769 95894->95893 95895 7ddbf9 FindClose 95894->95895 95895->95893 95896->95788 95897->95788 95898->95786 95899->95786 95900->95786 95901->95786 95902->95791 95903->95786 95904 7c3f75 95915 78ceb1 95904->95915 95906 7c3f8b 95907 7c4006 95906->95907 95982 78e300 23 API calls 95906->95982 95924 77bf40 95907->95924 95911 7c3fe6 95914 7c4052 95911->95914 95983 7e1abf 22 API calls 95911->95983 95912 7c4a88 95914->95912 95984 7e359c 82 API calls __wsopen_s 95914->95984 95916 78cebf 95915->95916 95917 78ced2 95915->95917 95985 77aceb 23 API calls messages 95916->95985 95918 78cf05 95917->95918 95919 78ced7 95917->95919 95986 77aceb 23 API calls messages 95918->95986 95921 78fddb 22 API calls 95919->95921 95923 78cec9 95921->95923 95923->95906 95987 77adf0 95924->95987 95926 77bf9d 95927 7c04b6 95926->95927 95928 77bfa9 95926->95928 96006 7e359c 82 API calls __wsopen_s 95927->96006 95930 7c04c6 95928->95930 95931 77c01e 95928->95931 96007 7e359c 82 API calls __wsopen_s 95930->96007 95992 77ac91 95931->95992 95934 77c7da 95938 78fe0b 22 API calls 95934->95938 95943 77c808 __fread_nolock 95938->95943 95940 7c04f5 95944 7c055a 95940->95944 96008 78d217 185 API calls 95940->96008 95949 78fe0b 22 API calls 95943->95949 95967 77c603 95944->95967 96009 7e359c 82 API calls __wsopen_s 95944->96009 95945 77ec40 185 API calls 95978 77c039 __fread_nolock messages 95945->95978 95946 77af8a 22 API calls 95946->95978 95947 7d7120 22 API calls 95947->95978 95948 7c091a 96019 7e3209 23 API calls 95948->96019 95979 77c350 __fread_nolock messages 95949->95979 95952 7c08a5 95953 77ec40 185 API calls 95952->95953 95954 7c08cf 95953->95954 95954->95967 96017 77a81b 41 API calls 95954->96017 95956 7c0591 96010 7e359c 82 API calls __wsopen_s 95956->96010 95959 7c08f6 96018 7e359c 82 API calls __wsopen_s 95959->96018 95962 77bbe0 40 API calls 95962->95978 95963 77c237 95965 77c253 95963->95965 96020 77a8c7 22 API calls __fread_nolock 95963->96020 95968 7c0976 95965->95968 95972 77c297 messages 95965->95972 95967->95914 96021 77aceb 23 API calls messages 95968->96021 95971 7c09bf 95971->95967 96022 7e359c 82 API calls __wsopen_s 95971->96022 95972->95971 96003 77aceb 23 API calls messages 95972->96003 95973 78fddb 22 API calls 95973->95978 95975 77c335 95975->95971 95976 77c342 95975->95976 96004 77a704 22 API calls messages 95976->96004 95978->95934 95978->95940 95978->95943 95978->95944 95978->95945 95978->95946 95978->95947 95978->95948 95978->95952 95978->95956 95978->95959 95978->95962 95978->95963 95978->95967 95978->95971 95978->95973 95980 78fe0b 22 API calls 95978->95980 95996 77ad81 95978->95996 96011 7d7099 22 API calls __fread_nolock 95978->96011 96012 7f5745 54 API calls _wcslen 95978->96012 96013 78aa42 22 API calls messages 95978->96013 96014 7df05c 40 API calls 95978->96014 96015 77a993 41 API calls 95978->96015 96016 77aceb 23 API calls messages 95978->96016 95981 77c3ac 95979->95981 96005 78ce17 22 API calls messages 95979->96005 95980->95978 95981->95914 95982->95911 95983->95907 95984->95912 95985->95923 95986->95923 95988 77ae01 95987->95988 95991 77ae1c messages 95987->95991 95989 77aec9 22 API calls 95988->95989 95990 77ae09 CharUpperBuffW 95989->95990 95990->95991 95991->95926 95993 77acae 95992->95993 95994 77acd1 95993->95994 96023 7e359c 82 API calls __wsopen_s 95993->96023 95994->95978 95997 7bfadb 95996->95997 95998 77ad92 95996->95998 95999 78fddb 22 API calls 95998->95999 96000 77ad99 95999->96000 96024 77adcd 96000->96024 96003->95975 96004->95979 96005->95979 96006->95930 96007->95967 96008->95944 96009->95967 96010->95967 96011->95978 96012->95978 96013->95978 96014->95978 96015->95978 96016->95978 96017->95959 96018->95967 96019->95963 96020->95965 96021->95971 96022->95967 96023->95994 96027 77addd 96024->96027 96025 77adb6 96025->95978 96026 78fddb 22 API calls 96026->96027 96027->96025 96027->96026 96028 77a961 22 API calls 96027->96028 96030 77adcd 22 API calls 96027->96030 96031 77a8c7 22 API calls __fread_nolock 96027->96031 96028->96027 96030->96027 96031->96027 96032 77105b 96037 77344d 96032->96037 96034 77106a 96068 7900a3 29 API calls __onexit 96034->96068 96036 771074 96038 77345d __wsopen_s 96037->96038 96039 77a961 22 API calls 96038->96039 96040 773513 96039->96040 96041 773a5a 24 API calls 96040->96041 96042 77351c 96041->96042 96069 773357 96042->96069 96045 7733c6 22 API calls 96046 773535 96045->96046 96047 77515f 22 API calls 96046->96047 96048 773544 96047->96048 96049 77a961 22 API calls 96048->96049 96050 77354d 96049->96050 96051 77a6c3 22 API calls 96050->96051 96052 773556 RegOpenKeyExW 96051->96052 96053 7b3176 RegQueryValueExW 96052->96053 96058 773578 96052->96058 96054 7b320c RegCloseKey 96053->96054 96055 7b3193 96053->96055 96054->96058 96067 7b321e _wcslen 96054->96067 96056 78fe0b 22 API calls 96055->96056 96057 7b31ac 96056->96057 96060 775722 22 API calls 96057->96060 96058->96034 96059 774c6d 22 API calls 96059->96067 96061 7b31b7 RegQueryValueExW 96060->96061 96062 7b31d4 96061->96062 96064 7b31ee messages 96061->96064 96063 776b57 22 API calls 96062->96063 96063->96064 96064->96054 96065 779cb3 22 API calls 96065->96067 96066 77515f 22 API calls 96066->96067 96067->96058 96067->96059 96067->96065 96067->96066 96068->96036 96070 7b1f50 __wsopen_s 96069->96070 96071 773364 GetFullPathNameW 96070->96071 96072 773386 96071->96072 96073 776b57 22 API calls 96072->96073 96074 7733a4 96073->96074 96074->96045 96075 771098 96080 7742de 96075->96080 96079 7710a7 96081 77a961 22 API calls 96080->96081 96082 7742f5 GetVersionExW 96081->96082 96083 776b57 22 API calls 96082->96083 96084 774342 96083->96084 96085 7793b2 22 API calls 96084->96085 96094 774378 96084->96094 96086 77436c 96085->96086 96088 7737a0 22 API calls 96086->96088 96087 77441b GetCurrentProcess IsWow64Process 96089 774437 96087->96089 96088->96094 96090 77444f LoadLibraryA 96089->96090 96091 7b3824 GetSystemInfo 96089->96091 96092 774460 GetProcAddress 96090->96092 96093 77449c GetSystemInfo 96090->96093 96092->96093 96096 774470 GetNativeSystemInfo 96092->96096 96097 774476 96093->96097 96094->96087 96095 7b37df 96094->96095 96096->96097 96098 77109d 96097->96098 96099 77447a FreeLibrary 96097->96099 96100 7900a3 29 API calls __onexit 96098->96100 96099->96098 96100->96079 96101 771044 96106 7710f3 96101->96106 96103 77104a 96142 7900a3 29 API calls __onexit 96103->96142 96105 771054 96143 771398 96106->96143 96110 77116a 96111 77a961 22 API calls 96110->96111 96112 771174 96111->96112 96113 77a961 22 API calls 96112->96113 96114 77117e 96113->96114 96115 77a961 22 API calls 96114->96115 96116 771188 96115->96116 96117 77a961 22 API calls 96116->96117 96118 7711c6 96117->96118 96119 77a961 22 API calls 96118->96119 96120 771292 96119->96120 96153 77171c 96120->96153 96124 7712c4 96125 77a961 22 API calls 96124->96125 96126 7712ce 96125->96126 96127 781940 9 API calls 96126->96127 96128 7712f9 96127->96128 96174 771aab 96128->96174 96130 771315 96131 771325 GetStdHandle 96130->96131 96132 7b2485 96131->96132 96135 77137a 96131->96135 96133 7b248e 96132->96133 96132->96135 96134 78fddb 22 API calls 96133->96134 96136 7b2495 96134->96136 96137 771387 OleInitialize 96135->96137 96181 7e011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 96136->96181 96137->96103 96139 7b249e 96182 7e0944 CreateThread 96139->96182 96141 7b24aa CloseHandle 96141->96135 96142->96105 96183 7713f1 96143->96183 96146 7713f1 22 API calls 96147 7713d0 96146->96147 96148 77a961 22 API calls 96147->96148 96149 7713dc 96148->96149 96150 776b57 22 API calls 96149->96150 96151 771129 96150->96151 96152 771bc3 6 API calls 96151->96152 96152->96110 96154 77a961 22 API calls 96153->96154 96155 77172c 96154->96155 96156 77a961 22 API calls 96155->96156 96157 771734 96156->96157 96158 77a961 22 API calls 96157->96158 96159 77174f 96158->96159 96160 78fddb 22 API calls 96159->96160 96161 77129c 96160->96161 96162 771b4a 96161->96162 96163 771b58 96162->96163 96164 77a961 22 API calls 96163->96164 96165 771b63 96164->96165 96166 77a961 22 API calls 96165->96166 96167 771b6e 96166->96167 96168 77a961 22 API calls 96167->96168 96169 771b79 96168->96169 96170 77a961 22 API calls 96169->96170 96171 771b84 96170->96171 96172 78fddb 22 API calls 96171->96172 96173 771b96 RegisterWindowMessageW 96172->96173 96173->96124 96175 7b272d 96174->96175 96176 771abb 96174->96176 96190 7e3209 23 API calls 96175->96190 96178 78fddb 22 API calls 96176->96178 96180 771ac3 96178->96180 96179 7b2738 96180->96130 96181->96139 96182->96141 96191 7e092a 28 API calls 96182->96191 96184 77a961 22 API calls 96183->96184 96185 7713fc 96184->96185 96186 77a961 22 API calls 96185->96186 96187 771404 96186->96187 96188 77a961 22 API calls 96187->96188 96189 7713c6 96188->96189 96189->96146 96190->96179 96192 772de3 96193 772df0 __wsopen_s 96192->96193 96194 7b2c2b ___scrt_fastfail 96193->96194 96195 772e09 96193->96195 96198 7b2c47 GetOpenFileNameW 96194->96198 96196 773aa2 23 API calls 96195->96196 96197 772e12 96196->96197 96208 772da5 96197->96208 96200 7b2c96 96198->96200 96201 776b57 22 API calls 96200->96201 96203 7b2cab 96201->96203 96203->96203 96205 772e27 96226 7744a8 96205->96226 96209 7b1f50 __wsopen_s 96208->96209 96210 772db2 GetLongPathNameW 96209->96210 96211 776b57 22 API calls 96210->96211 96212 772dda 96211->96212 96213 773598 96212->96213 96214 77a961 22 API calls 96213->96214 96215 7735aa 96214->96215 96216 773aa2 23 API calls 96215->96216 96217 7735b5 96216->96217 96218 7735c0 96217->96218 96223 7b32eb 96217->96223 96220 77515f 22 API calls 96218->96220 96221 7735cc 96220->96221 96255 7735f3 96221->96255 96222 7b330d 96223->96222 96261 78ce60 41 API calls 96223->96261 96225 7735df 96225->96205 96227 774ecb 94 API calls 96226->96227 96228 7744cd 96227->96228 96229 7b3833 96228->96229 96231 774ecb 94 API calls 96228->96231 96230 7e2cf9 80 API calls 96229->96230 96232 7b3848 96230->96232 96233 7744e1 96231->96233 96234 7b3869 96232->96234 96235 7b384c 96232->96235 96233->96229 96236 7744e9 96233->96236 96238 78fe0b 22 API calls 96234->96238 96237 774f39 68 API calls 96235->96237 96239 7744f5 96236->96239 96240 7b3854 96236->96240 96237->96240 96253 7b38ae 96238->96253 96262 77940c 136 API calls 2 library calls 96239->96262 96263 7dda5a 82 API calls 96240->96263 96243 7b3862 96243->96234 96244 772e31 96245 774f39 68 API calls 96248 7b3a5f 96245->96248 96248->96245 96269 7d989b 82 API calls __wsopen_s 96248->96269 96251 779cb3 22 API calls 96251->96253 96253->96248 96253->96251 96264 7d967e 22 API calls __fread_nolock 96253->96264 96265 7d95ad 42 API calls _wcslen 96253->96265 96266 7e0b5a 22 API calls 96253->96266 96267 77a4a1 22 API calls __fread_nolock 96253->96267 96268 773ff7 22 API calls 96253->96268 96256 773605 96255->96256 96260 773624 __fread_nolock 96255->96260 96258 78fe0b 22 API calls 96256->96258 96257 78fddb 22 API calls 96259 77363b 96257->96259 96258->96260 96259->96225 96260->96257 96261->96223 96262->96244 96263->96243 96264->96253 96265->96253 96266->96253 96267->96253 96268->96253 96269->96248 96270 7a8402 96275 7a81be 96270->96275 96273 7a842a 96281 7a81ef try_get_first_available_module 96275->96281 96276 7a8338 96280 7a8343 96276->96280 96293 79f2d9 20 API calls __dosmaperr 96276->96293 96278 7a83ee 96294 7a27ec 26 API calls __cftof 96278->96294 96280->96273 96287 7b0984 96280->96287 96281->96276 96290 798e0b 40 API calls 2 library calls 96281->96290 96283 7a838c 96283->96276 96291 798e0b 40 API calls 2 library calls 96283->96291 96285 7a83ab 96285->96276 96292 798e0b 40 API calls 2 library calls 96285->96292 96295 7b0081 96287->96295 96289 7b099f 96289->96273 96290->96283 96291->96285 96292->96276 96293->96278 96294->96280 96298 7b008d ___BuildCatchObject 96295->96298 96296 7b009b 96353 79f2d9 20 API calls __dosmaperr 96296->96353 96298->96296 96300 7b00d4 96298->96300 96299 7b00a0 96354 7a27ec 26 API calls __cftof 96299->96354 96306 7b065b 96300->96306 96305 7b00aa __wsopen_s 96305->96289 96356 7b042f 96306->96356 96309 7b068d 96388 79f2c6 20 API calls __dosmaperr 96309->96388 96310 7b06a6 96374 7a5221 96310->96374 96313 7b06ab 96314 7b06cb 96313->96314 96315 7b06b4 96313->96315 96387 7b039a CreateFileW 96314->96387 96390 79f2c6 20 API calls __dosmaperr 96315->96390 96319 7b06b9 96391 79f2d9 20 API calls __dosmaperr 96319->96391 96321 7b0781 GetFileType 96322 7b078c GetLastError 96321->96322 96327 7b07d3 96321->96327 96394 79f2a3 20 API calls 2 library calls 96322->96394 96323 7b0704 96323->96321 96324 7b0756 GetLastError 96323->96324 96392 7b039a CreateFileW 96323->96392 96393 79f2a3 20 API calls 2 library calls 96324->96393 96396 7a516a 21 API calls 3 library calls 96327->96396 96328 7b0692 96389 79f2d9 20 API calls __dosmaperr 96328->96389 96329 7b079a CloseHandle 96329->96328 96331 7b07c3 96329->96331 96395 79f2d9 20 API calls __dosmaperr 96331->96395 96333 7b0749 96333->96321 96333->96324 96334 7b07f4 96336 7b0840 96334->96336 96397 7b05ab 72 API calls 4 library calls 96334->96397 96341 7b086d 96336->96341 96398 7b014d 72 API calls 4 library calls 96336->96398 96337 7b07c8 96337->96328 96340 7b0866 96340->96341 96342 7b087e 96340->96342 96343 7a86ae __wsopen_s 29 API calls 96341->96343 96344 7b00f8 96342->96344 96345 7b08fc CloseHandle 96342->96345 96343->96344 96355 7b0121 LeaveCriticalSection __wsopen_s 96344->96355 96399 7b039a CreateFileW 96345->96399 96347 7b0927 96348 7b095d 96347->96348 96349 7b0931 GetLastError 96347->96349 96348->96344 96400 79f2a3 20 API calls 2 library calls 96349->96400 96351 7b093d 96401 7a5333 21 API calls 3 library calls 96351->96401 96353->96299 96354->96305 96355->96305 96357 7b0450 96356->96357 96358 7b046a 96356->96358 96357->96358 96409 79f2d9 20 API calls __dosmaperr 96357->96409 96402 7b03bf 96358->96402 96361 7b045f 96410 7a27ec 26 API calls __cftof 96361->96410 96363 7b04a2 96364 7b04d1 96363->96364 96411 79f2d9 20 API calls __dosmaperr 96363->96411 96367 7b0524 96364->96367 96413 79d70d 26 API calls 2 library calls 96364->96413 96367->96309 96367->96310 96368 7b051f 96368->96367 96370 7b059e 96368->96370 96369 7b04c6 96412 7a27ec 26 API calls __cftof 96369->96412 96414 7a27fc 11 API calls _abort 96370->96414 96373 7b05aa 96375 7a522d ___BuildCatchObject 96374->96375 96417 7a2f5e EnterCriticalSection 96375->96417 96377 7a5234 96378 7a527b 96377->96378 96380 7a5259 96377->96380 96384 7a52c7 EnterCriticalSection 96377->96384 96418 7a532a 96378->96418 96382 7a5000 __wsopen_s 21 API calls 96380->96382 96381 7a52a4 __wsopen_s 96381->96313 96383 7a525e 96382->96383 96383->96378 96421 7a5147 EnterCriticalSection 96383->96421 96384->96378 96386 7a52d4 LeaveCriticalSection 96384->96386 96386->96377 96387->96323 96388->96328 96389->96344 96390->96319 96391->96328 96392->96333 96393->96328 96394->96329 96395->96337 96396->96334 96397->96336 96398->96340 96399->96347 96400->96351 96401->96348 96404 7b03d7 96402->96404 96403 7b03f2 96403->96363 96404->96403 96415 79f2d9 20 API calls __dosmaperr 96404->96415 96406 7b0416 96416 7a27ec 26 API calls __cftof 96406->96416 96408 7b0421 96408->96363 96409->96361 96410->96358 96411->96369 96412->96364 96413->96368 96414->96373 96415->96406 96416->96408 96417->96377 96422 7a2fa6 LeaveCriticalSection 96418->96422 96420 7a5331 96420->96381 96421->96378 96422->96420 96423 7b2402 96426 771410 96423->96426 96427 7b24b8 DestroyWindow 96426->96427 96428 77144f mciSendStringW 96426->96428 96438 7b24c4 96427->96438 96429 77146b 96428->96429 96435 7716c6 96428->96435 96430 771479 96429->96430 96429->96438 96459 77182e 96430->96459 96431 7716d5 UnregisterHotKey 96431->96435 96433 7b24e2 FindClose 96433->96438 96435->96429 96435->96431 96436 7b2509 96441 7b252d 96436->96441 96442 7b251c FreeLibrary 96436->96442 96438->96433 96438->96436 96440 7b24d8 96438->96440 96439 77148e 96439->96441 96449 77149c 96439->96449 96440->96438 96465 776246 CloseHandle 96440->96465 96443 7b2541 VirtualFree 96441->96443 96450 771509 96441->96450 96442->96436 96443->96441 96444 7714f8 OleUninitialize 96444->96450 96445 7b2589 96452 7b2598 messages 96445->96452 96466 7e32eb 6 API calls messages 96445->96466 96446 771514 96447 771524 96446->96447 96463 771944 VirtualFreeEx CloseHandle 96447->96463 96449->96444 96450->96445 96450->96446 96455 7b2627 96452->96455 96467 7d64d4 22 API calls messages 96452->96467 96454 77153a 96454->96452 96456 77161f 96454->96456 96455->96455 96456->96455 96464 771876 CloseHandle InternetCloseHandle InternetCloseHandle WaitForSingleObject 96456->96464 96458 7716c1 96460 77183b 96459->96460 96461 771480 96460->96461 96468 7d702a 22 API calls 96460->96468 96461->96436 96461->96439 96463->96454 96464->96458 96465->96440 96466->96445 96467->96452 96468->96460 96469 771cad SystemParametersInfoW 96470 7c2a00 96485 77d7b0 messages 96470->96485 96471 77db11 PeekMessageW 96471->96485 96472 77d807 GetInputState 96472->96471 96472->96485 96473 7c1cbe TranslateAcceleratorW 96473->96485 96475 77db8f PeekMessageW 96475->96485 96476 77da04 timeGetTime 96476->96485 96477 77db73 TranslateMessage DispatchMessageW 96477->96475 96478 77dbaf Sleep 96496 77dbc0 96478->96496 96479 7c2b74 Sleep 96479->96496 96480 78e551 timeGetTime 96480->96496 96481 7c1dda timeGetTime 96511 78e300 23 API calls 96481->96511 96482 7dd4dc 47 API calls 96482->96496 96484 7c2c0b GetExitCodeProcess 96486 7c2c37 CloseHandle 96484->96486 96487 7c2c21 WaitForSingleObject 96484->96487 96485->96471 96485->96472 96485->96473 96485->96475 96485->96476 96485->96477 96485->96478 96485->96479 96485->96481 96489 77d9d5 96485->96489 96498 77ec40 185 API calls 96485->96498 96499 781310 185 API calls 96485->96499 96500 77bf40 185 API calls 96485->96500 96502 77dd50 96485->96502 96509 77dfd0 185 API calls 3 library calls 96485->96509 96510 78edf6 IsDialogMessageW GetClassLongW 96485->96510 96512 7e3a2a 23 API calls 96485->96512 96513 7e359c 82 API calls __wsopen_s 96485->96513 96486->96496 96487->96485 96487->96486 96488 7c2a31 96488->96489 96490 8029bf GetForegroundWindow 96490->96496 96492 7c2ca9 Sleep 96492->96485 96496->96480 96496->96482 96496->96484 96496->96485 96496->96488 96496->96489 96496->96490 96496->96492 96514 7f5658 23 API calls 96496->96514 96515 7de97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 96496->96515 96498->96485 96499->96485 96500->96485 96503 77dd83 96502->96503 96504 77dd6f 96502->96504 96548 7e359c 82 API calls __wsopen_s 96503->96548 96516 77d260 96504->96516 96507 77dd7a 96507->96485 96508 7c2f75 96508->96508 96509->96485 96510->96485 96511->96485 96512->96485 96513->96485 96514->96496 96515->96496 96517 77ec40 185 API calls 96516->96517 96520 77d29d 96517->96520 96519 77d30b messages 96519->96507 96520->96519 96521 77d6d5 96520->96521 96522 77d3c3 96520->96522 96528 77d4b8 96520->96528 96531 78fddb 22 API calls 96520->96531 96534 7c1bc4 96520->96534 96543 77d429 __fread_nolock messages 96520->96543 96521->96519 96532 78fe0b 22 API calls 96521->96532 96522->96521 96524 77d3ce 96522->96524 96523 77d5ff 96526 77d614 96523->96526 96527 7c1bb5 96523->96527 96525 78fddb 22 API calls 96524->96525 96536 77d3d5 __fread_nolock 96525->96536 96529 78fddb 22 API calls 96526->96529 96554 7f5705 23 API calls 96527->96554 96533 78fe0b 22 API calls 96528->96533 96540 77d46a 96529->96540 96531->96520 96532->96536 96533->96543 96555 7e359c 82 API calls __wsopen_s 96534->96555 96535 78fddb 22 API calls 96537 77d3f6 96535->96537 96536->96535 96536->96537 96537->96543 96549 77bec0 185 API calls 96537->96549 96539 7c1ba4 96553 7e359c 82 API calls __wsopen_s 96539->96553 96540->96507 96543->96523 96543->96539 96543->96540 96544 7c1b7f 96543->96544 96546 7c1b5d 96543->96546 96550 771f6f 185 API calls 96543->96550 96552 7e359c 82 API calls __wsopen_s 96544->96552 96551 7e359c 82 API calls __wsopen_s 96546->96551 96548->96508 96549->96543 96550->96543 96551->96540 96552->96540 96553->96540 96554->96534 96555->96519 96556 7b2ba5 96557 772b25 96556->96557 96558 7b2baf 96556->96558 96584 772b83 7 API calls 96557->96584 96560 773a5a 24 API calls 96558->96560 96562 7b2bb8 96560->96562 96564 779cb3 22 API calls 96562->96564 96565 7b2bc6 96564->96565 96566 7b2bce 96565->96566 96567 7b2bf5 96565->96567 96569 7733c6 22 API calls 96566->96569 96570 7733c6 22 API calls 96567->96570 96568 772b2f 96571 773837 49 API calls 96568->96571 96575 772b44 96568->96575 96572 7b2bd9 96569->96572 96573 7b2bf1 GetForegroundWindow ShellExecuteW 96570->96573 96571->96575 96588 776350 22 API calls 96572->96588 96580 7b2c26 96573->96580 96574 772b5f 96581 772b66 SetCurrentDirectoryW 96574->96581 96575->96574 96578 7730f2 Shell_NotifyIconW 96575->96578 96578->96574 96579 7b2be7 96582 7733c6 22 API calls 96579->96582 96580->96574 96583 772b7a 96581->96583 96582->96573 96589 772cd4 7 API calls 96584->96589 96586 772b2a 96587 772c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 96586->96587 96587->96568 96588->96579 96589->96586

                                                                Executed Functions

                                                                Function 007742DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 245 7742de-77434d call 77a961 GetVersionExW call 776b57 250 774353 245->250 251 7b3617-7b362a 245->251 253 774355-774357 250->253 252 7b362b-7b362f 251->252 254 7b3632-7b363e 252->254 255 7b3631 252->255 256 77435d-7743bc call 7793b2 call 7737a0 253->256 257 7b3656 253->257 254->252 258 7b3640-7b3642 254->258 255->254 274 7b37df-7b37e6 256->274 275 7743c2-7743c4 256->275 261 7b365d-7b3660 257->261 258->253 260 7b3648-7b364f 258->260 260->251 263 7b3651 260->263 264 77441b-774435 GetCurrentProcess IsWow64Process 261->264 265 7b3666-7b36a8 261->265 263->257 267 774437 264->267 268 774494-77449a 264->268 265->264 269 7b36ae-7b36b1 265->269 271 77443d-774449 267->271 268->271 272 7b36db-7b36e5 269->272 273 7b36b3-7b36bd 269->273 280 77444f-77445e LoadLibraryA 271->280 281 7b3824-7b3828 GetSystemInfo 271->281 276 7b36f8-7b3702 272->276 277 7b36e7-7b36f3 272->277 282 7b36ca-7b36d6 273->282 283 7b36bf-7b36c5 273->283 278 7b37e8 274->278 279 7b3806-7b3809 274->279 275->261 284 7743ca-7743dd 275->284 288 7b3715-7b3721 276->288 289 7b3704-7b3710 276->289 277->264 287 7b37ee 278->287 290 7b380b-7b381a 279->290 291 7b37f4-7b37fc 279->291 292 774460-77446e GetProcAddress 280->292 293 77449c-7744a6 GetSystemInfo 280->293 282->264 283->264 285 7743e3-7743e5 284->285 286 7b3726-7b372f 284->286 294 7b374d-7b3762 285->294 295 7743eb-7743ee 285->295 296 7b373c-7b3748 286->296 297 7b3731-7b3737 286->297 287->291 288->264 289->264 290->287 298 7b381c-7b3822 290->298 291->279 292->293 299 774470-774474 GetNativeSystemInfo 292->299 300 774476-774478 293->300 303 7b376f-7b377b 294->303 304 7b3764-7b376a 294->304 301 7743f4-77440f 295->301 302 7b3791-7b3794 295->302 296->264 297->264 298->291 299->300 305 774481-774493 300->305 306 77447a-77447b FreeLibrary 300->306 307 774415 301->307 308 7b3780-7b378c 301->308 302->264 309 7b379a-7b37c1 302->309 303->264 304->264 306->305 307->264 308->264 310 7b37ce-7b37da 309->310 311 7b37c3-7b37c9 309->311 310->264 311->264
                                                                APIs
                                                                • GetVersionExW.KERNEL32(?), ref: 0077430D
                                                                  • Part of subcall function 00776B57: _wcslen.LIBCMT ref: 00776B6A
                                                                • GetCurrentProcess.KERNEL32(?,0080CB64,00000000,?,?), ref: 00774422
                                                                • IsWow64Process.KERNEL32(00000000,?,?), ref: 00774429
                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00774454
                                                                • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00774466
                                                                • GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00774474
                                                                • FreeLibrary.KERNEL32(00000000,?,?), ref: 0077447B
                                                                • GetSystemInfo.KERNEL32(?,?,?), ref: 007744A0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                                • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                                • API String ID: 3290436268-3101561225
                                                                • Opcode ID: 1887a12ac4ddadad8a7ed9425090215913af7e49a0a1382f5696d7be5ab5232d
                                                                • Instruction ID: 9f07e03b1ba09a5ec632ca88a28043f760c66f3acb5feacc3cfd9e4bef341ef9
                                                                • Opcode Fuzzy Hash: 1887a12ac4ddadad8a7ed9425090215913af7e49a0a1382f5696d7be5ab5232d
                                                                • Instruction Fuzzy Hash: 04A1847A90A3C0DFCF11CF697C896E67FA47B27784B148899D04593B62E72C49C8DB21
                                                                Function 007742A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 649 7742a2-7742ba CreateStreamOnHGlobal 650 7742bc-7742d3 FindResourceExW 649->650 651 7742da-7742dd 649->651 652 7b35ba-7b35c9 LoadResource 650->652 653 7742d9 650->653 652->653 654 7b35cf-7b35dd SizeofResource 652->654 653->651 654->653 655 7b35e3-7b35ee LockResource 654->655 655->653 656 7b35f4-7b3612 655->656 656->653
                                                                APIs
                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,007750AA,?,?,00000000,00000000), ref: 007742B2
                                                                • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,007750AA,?,?,00000000,00000000), ref: 007742C9
                                                                • LoadResource.KERNEL32(?,00000000,?,?,007750AA,?,?,00000000,00000000,?,?,?,?,?,?,00774F20), ref: 007B35BE
                                                                • SizeofResource.KERNEL32(?,00000000,?,?,007750AA,?,?,00000000,00000000,?,?,?,?,?,?,00774F20), ref: 007B35D3
                                                                • LockResource.KERNEL32(007750AA,?,?,007750AA,?,?,00000000,00000000,?,?,?,?,?,?,00774F20,?), ref: 007B35E6
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                • String ID: SCRIPT
                                                                • API String ID: 3051347437-3967369404
                                                                • Opcode ID: 07c45ef8f61494a9921150b5ab97edee8f3694767d1c5930dda575ffc8862e81
                                                                • Instruction ID: 9f6fe591aef3a46c9db4bee463a26226469bb5ac6838789473ebfc7ea4b0a274
                                                                • Opcode Fuzzy Hash: 07c45ef8f61494a9921150b5ab97edee8f3694767d1c5930dda575ffc8862e81
                                                                • Instruction Fuzzy Hash: C1117C71200700BFDB218F65DC49F677BB9FBC5B91F208269B416D66A0DB71D8208A20
                                                                Function 007B2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00772B6B
                                                                  • Part of subcall function 00773A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00841418,?,00772E7F,?,?,?,00000000), ref: 00773A78
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • GetForegroundWindow.USER32(runas,?,?,?,?,?,00832224), ref: 007B2C10
                                                                • ShellExecuteW.SHELL32(00000000,?,?,00832224), ref: 007B2C17
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                                                                • String ID: runas
                                                                • API String ID: 448630720-4000483414
                                                                • Opcode ID: 309e64852b438930237960319626d416c6aed69d62283c4d2e3ba5867aba6f0e
                                                                • Instruction ID: f46aad7207e9747fc360d09b28e653423224a417e2f25551fa28d11a48c9afac
                                                                • Opcode Fuzzy Hash: 309e64852b438930237960319626d416c6aed69d62283c4d2e3ba5867aba6f0e
                                                                • Instruction Fuzzy Hash: E711E771204305DACF14FF60D85A9AEBBA5BB91780F04842DF15E520A3DF3C894AD752
                                                                Function 007DD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 007DD501
                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 007DD50F
                                                                • Process32NextW.KERNEL32(00000000,?), ref: 007DD52F
                                                                • FindCloseChangeNotification.KERNEL32(00000000), ref: 007DD5DC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
                                                                • String ID:
                                                                • API String ID: 3243318325-0
                                                                • Opcode ID: a223aa276fbb3523cfc56622b9aa0cd5c1cc2e0248c312fbd06b24ebe6d52664
                                                                • Instruction ID: 305e7a2840468ba73dddad30835ce826b4816ca6e7801e668a9ab46f5162c100
                                                                • Opcode Fuzzy Hash: a223aa276fbb3523cfc56622b9aa0cd5c1cc2e0248c312fbd06b24ebe6d52664
                                                                • Instruction Fuzzy Hash: D431C131108300DFD710EF64D885AAFBBF8EF99384F04452DF586822A1EB759945CBA2
                                                                Function 007DDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 918 7ddbbe-7ddbda lstrlenW 919 7ddbdc-7ddbe6 GetFileAttributesW 918->919 920 7ddc06 918->920 921 7ddc09-7ddc0d 919->921 922 7ddbe8-7ddbf7 FindFirstFileW 919->922 920->921 922->920 923 7ddbf9-7ddc04 FindClose 922->923 923->921
                                                                APIs
                                                                • lstrlenW.KERNEL32(?,007B5222), ref: 007DDBCE
                                                                • GetFileAttributesW.KERNEL32(?), ref: 007DDBDD
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 007DDBEE
                                                                • FindClose.KERNEL32(00000000), ref: 007DDBFA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FileFind$AttributesCloseFirstlstrlen
                                                                • String ID:
                                                                • API String ID: 2695905019-0
                                                                • Opcode ID: 9da2969af5ca1a681dd1c0bd99ad95f3e2a09ecd4f7a89978d961e7e29c0df3e
                                                                • Instruction ID: 1c4864f2a8bf153d9fd9eceb6d7889bd6e351290b8fb1e8ad864f54c1ba9195a
                                                                • Opcode Fuzzy Hash: 9da2969af5ca1a681dd1c0bd99ad95f3e2a09ecd4f7a89978d961e7e29c0df3e
                                                                • Instruction Fuzzy Hash: 62F0A0308209105BC2306F78AC0E8BA377CAE01334F204703F83AD22E1EBB45D5486A5
                                                                Function 00794CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentProcess.KERNEL32(007A28E9,?,00794CBE,007A28E9,008388B8,0000000C,00794E15,007A28E9,00000002,00000000,?,007A28E9), ref: 00794D09
                                                                • TerminateProcess.KERNEL32(00000000,?,00794CBE,007A28E9,008388B8,0000000C,00794E15,007A28E9,00000002,00000000,?,007A28E9), ref: 00794D10
                                                                • ExitProcess.KERNEL32 ref: 00794D22
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$CurrentExitTerminate
                                                                • String ID:
                                                                • API String ID: 1703294689-0
                                                                • Opcode ID: d99c33be8ebb6cb8d5c73680510ac5af609fb6933676ebf4ea242b8abd4af8b8
                                                                • Instruction ID: 66b174754b8d379d108f0dda24cbe19e51c53bb5a8de3e6c30f89d6dbb8fbd7d
                                                                • Opcode Fuzzy Hash: d99c33be8ebb6cb8d5c73680510ac5af609fb6933676ebf4ea242b8abd4af8b8
                                                                • Instruction Fuzzy Hash: F2E0B635110548ABCF55AF64ED09E583B69FB46781B118114FD058A232CB39DD42CA80
                                                                Function 0077D730 Relevance: 21.6, APIs: 14, Instructions: 631sleepsynchronizationtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetInputState.USER32 ref: 0077D807
                                                                • timeGetTime.WINMM ref: 0077DA07
                                                                • Sleep.KERNEL32(0000000A), ref: 0077DBB1
                                                                • Sleep.KERNEL32(0000000A), ref: 007C2B76
                                                                • GetExitCodeProcess.KERNEL32(?,?), ref: 007C2C11
                                                                • WaitForSingleObject.KERNEL32(?,00000000), ref: 007C2C29
                                                                • CloseHandle.KERNEL32(?), ref: 007C2C3D
                                                                • Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 007C2CA9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Sleep$CloseCodeExitHandleInputObjectProcessSingleStateTimeWaittime
                                                                • String ID:
                                                                • API String ID: 388478766-0
                                                                • Opcode ID: b6ef654f2d5803b079cf32fb4d9150d4bb722ecac88eca4c7429df2260b3b28c
                                                                • Instruction ID: ba39f8647f94b9fdd74c54d7113db97c74811a5b3adad0701ec3d93e2540f16f
                                                                • Opcode Fuzzy Hash: b6ef654f2d5803b079cf32fb4d9150d4bb722ecac88eca4c7429df2260b3b28c
                                                                • Instruction Fuzzy Hash: D642CE70608241DFDB39DF24C848F6AB7B0BF86344F54862DE55A872A2D778EC45CB92
                                                                Function 00772CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • GetSysColorBrush.USER32(0000000F), ref: 00772D07
                                                                • RegisterClassExW.USER32(00000030), ref: 00772D31
                                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00772D42
                                                                • InitCommonControlsEx.COMCTL32(?), ref: 00772D5F
                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00772D6F
                                                                • LoadIconW.USER32(000000A9), ref: 00772D85
                                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00772D94
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                • API String ID: 2914291525-1005189915
                                                                • Opcode ID: 893f64c99c6a3fb5c66482d49d915caa3550d7bccf5e37fd56040cce30a34d5b
                                                                • Instruction ID: a58a410bf1bb6095740fb4c18c3ee21614a5570affc121f5e5be9134f83fa7c6
                                                                • Opcode Fuzzy Hash: 893f64c99c6a3fb5c66482d49d915caa3550d7bccf5e37fd56040cce30a34d5b
                                                                • Instruction Fuzzy Hash: 2121C3B5951218AFDF40DFA4EC49BDDBFB4FB09700F00821AF611A62A0D7B55584CF91
                                                                Function 007B065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 313 7b065b-7b068b call 7b042f 316 7b068d-7b0698 call 79f2c6 313->316 317 7b06a6-7b06b2 call 7a5221 313->317 324 7b069a-7b06a1 call 79f2d9 316->324 322 7b06cb-7b0714 call 7b039a 317->322 323 7b06b4-7b06c9 call 79f2c6 call 79f2d9 317->323 333 7b0781-7b078a GetFileType 322->333 334 7b0716-7b071f 322->334 323->324 331 7b097d-7b0983 324->331 335 7b078c-7b07bd GetLastError call 79f2a3 CloseHandle 333->335 336 7b07d3-7b07d6 333->336 338 7b0721-7b0725 334->338 339 7b0756-7b077c GetLastError call 79f2a3 334->339 335->324 350 7b07c3-7b07ce call 79f2d9 335->350 342 7b07d8-7b07dd 336->342 343 7b07df-7b07e5 336->343 338->339 344 7b0727-7b0754 call 7b039a 338->344 339->324 347 7b07e9-7b0837 call 7a516a 342->347 343->347 348 7b07e7 343->348 344->333 344->339 355 7b0839-7b0845 call 7b05ab 347->355 356 7b0847-7b086b call 7b014d 347->356 348->347 350->324 355->356 362 7b086f-7b0879 call 7a86ae 355->362 363 7b087e-7b08c1 356->363 364 7b086d 356->364 362->331 366 7b08c3-7b08c7 363->366 367 7b08e2-7b08f0 363->367 364->362 366->367 369 7b08c9-7b08dd 366->369 370 7b097b 367->370 371 7b08f6-7b08fa 367->371 369->367 370->331 371->370 372 7b08fc-7b092f CloseHandle call 7b039a 371->372 375 7b0963-7b0977 372->375 376 7b0931-7b095d GetLastError call 79f2a3 call 7a5333 372->376 375->370 376->375
                                                                APIs
                                                                  • Part of subcall function 007B039A: CreateFileW.KERNEL32(00000000,00000000,?,007B0704,?,?,00000000,?,007B0704,00000000,0000000C), ref: 007B03B7
                                                                • GetLastError.KERNEL32 ref: 007B076F
                                                                • __dosmaperr.LIBCMT ref: 007B0776
                                                                • GetFileType.KERNEL32(00000000), ref: 007B0782
                                                                • GetLastError.KERNEL32 ref: 007B078C
                                                                • __dosmaperr.LIBCMT ref: 007B0795
                                                                • CloseHandle.KERNEL32(00000000), ref: 007B07B5
                                                                • CloseHandle.KERNEL32(?), ref: 007B08FF
                                                                • GetLastError.KERNEL32 ref: 007B0931
                                                                • __dosmaperr.LIBCMT ref: 007B0938
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                • String ID: H
                                                                • API String ID: 4237864984-2852464175
                                                                • Opcode ID: 7c3229a8449b0a98bf12c225bb7133071f8232c29447e9f453878cae68a260f3
                                                                • Instruction ID: 474caa6ba15c17d8fc4760db6a351cc596a405d87a09ea6e22ff3e30cdac3da5
                                                                • Opcode Fuzzy Hash: 7c3229a8449b0a98bf12c225bb7133071f8232c29447e9f453878cae68a260f3
                                                                • Instruction Fuzzy Hash: 1FA12336A141088FDF19AF68D856BEE7BA0AB46324F14029DF811DB3D1DB399912CBD1
                                                                Function 0077344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                  • Part of subcall function 00773A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00841418,?,00772E7F,?,?,?,00000000), ref: 00773A78
                                                                  • Part of subcall function 00773357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00773379
                                                                • RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0077356A
                                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 007B318D
                                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007B31CE
                                                                • RegCloseKey.ADVAPI32(?), ref: 007B3210
                                                                • _wcslen.LIBCMT ref: 007B3277
                                                                • _wcslen.LIBCMT ref: 007B3286
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                                • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                • API String ID: 98802146-2727554177
                                                                • Opcode ID: 7760a096e12182ab0ee4203d2f9b34e3244f61e8c8fa623460dc3e9c466cc900
                                                                • Instruction ID: 4f7f01f5cd69339a39efd497d3c489cab682867a3e6fdfd5a4e41c237364adfb
                                                                • Opcode Fuzzy Hash: 7760a096e12182ab0ee4203d2f9b34e3244f61e8c8fa623460dc3e9c466cc900
                                                                • Instruction Fuzzy Hash: 51716C71508301DEC714EF69DC8699BBBF8FF95780B80452EF559832B1DB389A48CB62
                                                                Function 00772B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • GetSysColorBrush.USER32(0000000F), ref: 00772B8E
                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00772B9D
                                                                • LoadIconW.USER32(00000063), ref: 00772BB3
                                                                • LoadIconW.USER32(000000A4), ref: 00772BC5
                                                                • LoadIconW.USER32(000000A2), ref: 00772BD7
                                                                • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00772BEF
                                                                • RegisterClassExW.USER32(?), ref: 00772C40
                                                                  • Part of subcall function 00772CD4: GetSysColorBrush.USER32(0000000F), ref: 00772D07
                                                                  • Part of subcall function 00772CD4: RegisterClassExW.USER32(00000030), ref: 00772D31
                                                                  • Part of subcall function 00772CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00772D42
                                                                  • Part of subcall function 00772CD4: InitCommonControlsEx.COMCTL32(?), ref: 00772D5F
                                                                  • Part of subcall function 00772CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00772D6F
                                                                  • Part of subcall function 00772CD4: LoadIconW.USER32(000000A9), ref: 00772D85
                                                                  • Part of subcall function 00772CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00772D94
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                • String ID: #$0$AutoIt v3
                                                                • API String ID: 423443420-4155596026
                                                                • Opcode ID: 2942e138c8e80b0fb19930b4a6174b8ff5211a1dfda8070807fdb9419a998f60
                                                                • Instruction ID: 7f5616e04ce0bca74621bd0e09d6e1c82ea56cb8af6421c05873718bf082b31d
                                                                • Opcode Fuzzy Hash: 2942e138c8e80b0fb19930b4a6174b8ff5211a1dfda8070807fdb9419a998f60
                                                                • Instruction Fuzzy Hash: 41212C78E40318ABDF109FA9EC59B99BFB4FB49B50F00451AF504A67A0D7B90580CF90
                                                                Function 00773170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 454 773170-773185 455 773187-77318a 454->455 456 7731e5-7731e7 454->456 458 77318c-773193 455->458 459 7731eb 455->459 456->455 457 7731e9 456->457 460 7731d0-7731d8 DefWindowProcW 457->460 463 773265-77326d PostQuitMessage 458->463 464 773199-77319e 458->464 461 7b2dfb-7b2e23 call 7718e2 call 78e499 459->461 462 7731f1-7731f6 459->462 465 7731de-7731e4 460->465 496 7b2e28-7b2e2f 461->496 467 77321d-773244 SetTimer RegisterWindowMessageW 462->467 468 7731f8-7731fb 462->468 466 773219-77321b 463->466 470 7731a4-7731a8 464->470 471 7b2e7c-7b2e90 call 7dbf30 464->471 466->465 467->466 475 773246-773251 CreatePopupMenu 467->475 472 773201-77320f KillTimer call 7730f2 468->472 473 7b2d9c-7b2d9f 468->473 476 7b2e68-7b2e77 call 7dc161 470->476 477 7731ae-7731b3 470->477 471->466 487 7b2e96 471->487 491 773214 call 773c50 472->491 479 7b2da1-7b2da5 473->479 480 7b2dd7-7b2df6 MoveWindow 473->480 475->466 476->466 484 7b2e4d-7b2e54 477->484 485 7731b9-7731be 477->485 488 7b2da7-7b2daa 479->488 489 7b2dc6-7b2dd2 SetFocus 479->489 480->466 484->460 490 7b2e5a-7b2e63 call 7d0ad7 484->490 494 7731c4-7731ca 485->494 495 773253-773263 call 77326f 485->495 487->460 488->494 497 7b2db0-7b2dc1 call 7718e2 488->497 489->466 490->460 491->466 494->460 494->496 495->466 496->460 502 7b2e35-7b2e48 call 7730f2 call 773837 496->502 497->466 502->460
                                                                APIs
                                                                • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0077316A,?,?), ref: 007731D8
                                                                • KillTimer.USER32(?,00000001,?,?,?,?,?,0077316A,?,?), ref: 00773204
                                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00773227
                                                                • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0077316A,?,?), ref: 00773232
                                                                • CreatePopupMenu.USER32 ref: 00773246
                                                                • PostQuitMessage.USER32(00000000), ref: 00773267
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                • String ID: TaskbarCreated
                                                                • API String ID: 129472671-2362178303
                                                                • Opcode ID: ad2a2a72f3412927685d826d5ff621161f6cf5a5531d05cf2fbee363321f6b0a
                                                                • Instruction ID: 6f69d68ab85ab86e9c3705f27b65321cc3e4328f5edf686bc172033e159ce5ac
                                                                • Opcode Fuzzy Hash: ad2a2a72f3412927685d826d5ff621161f6cf5a5531d05cf2fbee363321f6b0a
                                                                • Instruction Fuzzy Hash: 52410635254208EBDF155F7C9C0DBB93B5AF7063C4F548225F90AC62A2C77D8A81E7A2
                                                                Function 00771410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 510 771410-771449 511 7b24b8-7b24b9 DestroyWindow 510->511 512 77144f-771465 mciSendStringW 510->512 516 7b24c4-7b24d1 511->516 513 7716c6-7716d3 512->513 514 77146b-771473 512->514 517 7716d5-7716f0 UnregisterHotKey 513->517 518 7716f8-7716ff 513->518 515 771479-771488 call 77182e 514->515 514->516 531 7b250e-7b251a 515->531 532 77148e-771496 515->532 522 7b24d3-7b24d6 516->522 523 7b2500-7b2507 516->523 517->518 520 7716f2-7716f3 call 7710d0 517->520 518->514 521 771705 518->521 520->518 521->513 524 7b24d8-7b24e0 call 776246 522->524 525 7b24e2-7b24e5 FindClose 522->525 523->516 528 7b2509 523->528 530 7b24eb-7b24f8 524->530 525->530 528->531 530->523 534 7b24fa-7b24fb call 7e32b1 530->534 537 7b251c-7b251e FreeLibrary 531->537 538 7b2524-7b252b 531->538 535 7b2532-7b253f 532->535 536 77149c-7714c1 call 77cfa0 532->536 534->523 539 7b2541-7b255e VirtualFree 535->539 540 7b2566-7b256d 535->540 548 7714c3 536->548 549 7714f8-771503 OleUninitialize 536->549 537->538 538->531 543 7b252d 538->543 539->540 544 7b2560-7b2561 call 7e3317 539->544 540->535 545 7b256f 540->545 543->535 544->540 550 7b2574-7b2578 545->550 551 7714c6-7714f6 call 771a05 call 7719ae 548->551 549->550 552 771509-77150e 549->552 550->552 555 7b257e-7b2584 550->555 551->549 553 7b2589-7b2596 call 7e32eb 552->553 554 771514-77151e 552->554 568 7b2598 553->568 557 771707-771714 call 78f80e 554->557 558 771524-7715a5 call 77988f call 771944 call 7717d5 call 78fe14 call 77177c call 77988f call 77cfa0 call 7717fe call 78fe14 554->558 555->552 557->558 571 77171a 557->571 573 7b259d-7b25bf call 78fdcd 558->573 599 7715ab-7715cf call 78fe14 558->599 568->573 571->557 578 7b25c1 573->578 581 7b25c6-7b25e8 call 78fdcd 578->581 587 7b25ea 581->587 590 7b25ef-7b2611 call 78fdcd 587->590 597 7b2613 590->597 600 7b2618-7b2625 call 7d64d4 597->600 599->581 606 7715d5-7715f9 call 78fe14 599->606 605 7b2627 600->605 608 7b262c-7b2639 call 78ac64 605->608 606->590 611 7715ff-771619 call 78fe14 606->611 614 7b263b 608->614 611->600 616 77161f-771643 call 7717d5 call 78fe14 611->616 617 7b2640-7b264d call 7e3245 614->617 616->608 625 771649-771651 616->625 624 7b264f 617->624 627 7b2654-7b2661 call 7e32cc 624->627 625->617 626 771657-771675 call 77988f call 77190a 625->626 626->627 636 77167b-771689 626->636 632 7b2663 627->632 635 7b2668-7b2675 call 7e32cc 632->635 641 7b2677 635->641 636->635 638 77168f-7716c5 call 77988f * 3 call 771876 636->638 641->641
                                                                APIs
                                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00771459
                                                                • OleUninitialize.OLE32(?,00000000), ref: 007714F8
                                                                • UnregisterHotKey.USER32(?), ref: 007716DD
                                                                • DestroyWindow.USER32(?), ref: 007B24B9
                                                                • FreeLibrary.KERNEL32(?), ref: 007B251E
                                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 007B254B
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                • String ID: close all
                                                                • API String ID: 469580280-3243417748
                                                                • Opcode ID: 27c1a17ff20efe06ff5a61ac10e261466f5226319dc636b55d286744dfbd7a51
                                                                • Instruction ID: 1c4fa35659187f8dbd7ffbfc539e20e7f6e0a3e64be04c4f049ca4637e9e571d
                                                                • Opcode Fuzzy Hash: 27c1a17ff20efe06ff5a61ac10e261466f5226319dc636b55d286744dfbd7a51
                                                                • Instruction Fuzzy Hash: 2DD17331702212CFCB29EF15C899B69F7A4BF05740F5482ADE54AA7252DB38AD23CF51
                                                                Function 00772C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 659 772c63-772cd3 CreateWindowExW * 2 ShowWindow * 2
                                                                APIs
                                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00772C91
                                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00772CB2
                                                                • ShowWindow.USER32(00000000,?,?,?,?,?,?,00771CAD,?), ref: 00772CC6
                                                                • ShowWindow.USER32(00000000,?,?,?,?,?,?,00771CAD,?), ref: 00772CCF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$CreateShow
                                                                • String ID: AutoIt v3$edit
                                                                • API String ID: 1584632944-3779509399
                                                                • Opcode ID: c4067400e15aa2a402dd75bbd12eac1ec8794052d72cbb5b3fc7bef98890abda
                                                                • Instruction ID: 3d2de8467d88cac014a5e5b578bc03c1faf19bd696fa90a1cb4632c3f7563cfe
                                                                • Opcode Fuzzy Hash: c4067400e15aa2a402dd75bbd12eac1ec8794052d72cbb5b3fc7bef98890abda
                                                                • Instruction Fuzzy Hash: 55F0DA795402907AEB711F17AC4CE776EBDF7C7F50B00005AF900A26A0C6691894DAB0
                                                                Function 007FAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 774 7fad64-7fad9c call 77a961 call 792340 779 7fad9e-7fadb5 call 777510 774->779 780 7fadd1-7fadd5 774->780 779->780 791 7fadb7-7fadce call 777510 call 777620 779->791 781 7fadd7-7fadee call 777510 call 777620 780->781 782 7fadf1-7fadf5 780->782 781->782 785 7fae3a 782->785 786 7fadf7-7fae0e call 777510 782->786 789 7fae3c-7fae40 785->789 786->789 801 7fae10-7fae21 call 779b47 786->801 794 7fae53-7faeae call 792340 call 777510 ShellExecuteExW 789->794 795 7fae42-7fae50 call 77b567 789->795 791->780 811 7faeb7-7faeb9 794->811 812 7faeb0-7faeb6 call 78fe14 794->812 795->794 801->785 809 7fae23-7fae2e call 777510 801->809 809->785 819 7fae30-7fae35 call 77a8c7 809->819 816 7faebb-7faec1 call 78fe14 811->816 817 7faec2-7faec6 811->817 812->811 816->817 821 7faf0a-7faf0e 817->821 822 7faec8-7faed6 817->822 819->785 823 7faf1b-7faf33 call 77cfa0 821->823 824 7faf10-7faf19 821->824 827 7faedb-7faeeb 822->827 828 7faed8 822->828 829 7faf6d-7faf7b call 77988f 823->829 836 7faf35-7faf46 GetProcessId 823->836 824->829 831 7faeed 827->831 832 7faef0-7faf08 call 77cfa0 827->832 828->827 831->832 832->829 839 7faf4e-7faf67 call 77cfa0 CloseHandle 836->839 840 7faf48 836->840 839->829 840->839
                                                                APIs
                                                                • ShellExecuteExW.SHELL32(0000003C), ref: 007FAEA3
                                                                  • Part of subcall function 00777620: _wcslen.LIBCMT ref: 00777625
                                                                • GetProcessId.KERNEL32(00000000), ref: 007FAF38
                                                                • CloseHandle.KERNEL32(00000000), ref: 007FAF67
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseExecuteHandleProcessShell_wcslen
                                                                • String ID: <$@
                                                                • API String ID: 146682121-1426351568
                                                                • Opcode ID: e466209e3d56233487e511c11b94f74f93d3efe97f2c46ed9aefb2b5c974c0b0
                                                                • Instruction ID: 3a92902881ff0de680464def16262cc7b004e7cee5f4a78042154485759730f0
                                                                • Opcode Fuzzy Hash: e466209e3d56233487e511c11b94f74f93d3efe97f2c46ed9aefb2b5c974c0b0
                                                                • Instruction Fuzzy Hash: 00713B71A00619EFCF14DF54C485AAEBBF0BF08314F148499E91AAB352D778ED45CB91
                                                                Function 00773B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 879 773b1c-773b27 880 773b99-773b9b 879->880 881 773b29-773b2e 879->881 883 773b8c-773b8f 880->883 881->880 882 773b30-773b48 RegOpenKeyExW 881->882 882->880 884 773b4a-773b69 RegQueryValueExW 882->884 885 773b80-773b8b RegCloseKey 884->885 886 773b6b-773b76 884->886 885->883 887 773b90-773b97 886->887 888 773b78-773b7a 886->888 889 773b7e 887->889 888->889 889->885
                                                                APIs
                                                                • RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00773B0F,SwapMouseButtons,00000004,?), ref: 00773B40
                                                                • RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00773B0F,SwapMouseButtons,00000004,?), ref: 00773B61
                                                                • RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00773B0F,SwapMouseButtons,00000004,?), ref: 00773B83
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseOpenQueryValue
                                                                • String ID: Control Panel\Mouse
                                                                • API String ID: 3677997916-824357125
                                                                • Opcode ID: 339d531ad78d0b2e892f372b5c0bc193a7e46492e00eea651472e40deb3d2d02
                                                                • Instruction ID: 403b30edb2e5cc7d71ea9a2a16c2b972359a08b309ae91105d4585866afb87ac
                                                                • Opcode Fuzzy Hash: 339d531ad78d0b2e892f372b5c0bc193a7e46492e00eea651472e40deb3d2d02
                                                                • Instruction Fuzzy Hash: 0B112AB5510208FFDF208FA5DC44AEEB7BCEF04784B10856AA809D7120E2359E40A7A0
                                                                Function 00773923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 007B33A2
                                                                  • Part of subcall function 00776B57: _wcslen.LIBCMT ref: 00776B6A
                                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00773A04
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: IconLoadNotifyShell_String_wcslen
                                                                • String ID: Line:
                                                                • API String ID: 2289894680-1585850449
                                                                • Opcode ID: 2106e03ee347b6357f1031fbfca6421135efb13a8d363e447444ed10db4bcfea
                                                                • Instruction ID: f7e5da831a1d80b24195083a95b628124830ce4ddc76eb2099889f562c290fc5
                                                                • Opcode Fuzzy Hash: 2106e03ee347b6357f1031fbfca6421135efb13a8d363e447444ed10db4bcfea
                                                                • Instruction Fuzzy Hash: 5C31C771508304EACB21EF20DC49BEBB7D8BB41754F00891AF59D83191DB7C9688CBC2
                                                                Function 0078FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __CxxThrowException@8.LIBVCRUNTIME ref: 00790668
                                                                  • Part of subcall function 007932A4: RaiseException.KERNEL32(?,?,?,0079068A,?,00841444,?,?,?,?,?,?,0079068A,00771129,00838738,00771129), ref: 00793304
                                                                • __CxxThrowException@8.LIBVCRUNTIME ref: 00790685
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Exception@8Throw$ExceptionRaise
                                                                • String ID: Unknown exception
                                                                • API String ID: 3476068407-410509341
                                                                • Opcode ID: cffc55b2c9667de089913f1306753d71028cbdf71a908a46916ec280bbd21624
                                                                • Instruction ID: a0dd8e315083db8a9162737ac34c9f79ac1c64349f01e4ad05b6549dd193eecb
                                                                • Opcode Fuzzy Hash: cffc55b2c9667de089913f1306753d71028cbdf71a908a46916ec280bbd21624
                                                                • Instruction Fuzzy Hash: 42F0623490030DFBCF04B6A4F85AD9E776CAE40350B608571FA24D65D2EF79EA66C6D0
                                                                Function 007710F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00771BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00771BF4
                                                                  • Part of subcall function 00771BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00771BFC
                                                                  • Part of subcall function 00771BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00771C07
                                                                  • Part of subcall function 00771BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00771C12
                                                                  • Part of subcall function 00771BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00771C1A
                                                                  • Part of subcall function 00771BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00771C22
                                                                  • Part of subcall function 00771B4A: RegisterWindowMessageW.USER32(00000004,?,007712C4), ref: 00771BA2
                                                                • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0077136A
                                                                • OleInitialize.OLE32 ref: 00771388
                                                                • CloseHandle.KERNEL32(00000000,00000000), ref: 007B24AB
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                • String ID:
                                                                • API String ID: 1986988660-0
                                                                • Opcode ID: eed34adff1ecd7233758814076a7ad9b5279819aa2cca5e887b9a6fe9c818b4b
                                                                • Instruction ID: b0cc87b94a95e4694ea8b3beb34b29e01a12d45ab3d80a359ded78314b6cb5b9
                                                                • Opcode Fuzzy Hash: eed34adff1ecd7233758814076a7ad9b5279819aa2cca5e887b9a6fe9c818b4b
                                                                • Instruction Fuzzy Hash: 077199BCA513048ECF84EFB9EC4D6957AE1FB9A384356823AD61AC7261EB3444C5CF44
                                                                Function 007A86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,007A85CC,?,00838CC8,0000000C), ref: 007A8704
                                                                • GetLastError.KERNEL32(?,007A85CC,?,00838CC8,0000000C), ref: 007A870E
                                                                • __dosmaperr.LIBCMT ref: 007A8739
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ChangeCloseErrorFindLastNotification__dosmaperr
                                                                • String ID:
                                                                • API String ID: 490808831-0
                                                                • Opcode ID: 6fb9f3e1cbb23ea0a1a7812ba7e94642f17cd7067dceeb7897da0946940cb336
                                                                • Instruction ID: 5556a212c1223b67c6c300bad404f98ed10b76cfcc0f567d579aa77dded96fc9
                                                                • Opcode Fuzzy Hash: 6fb9f3e1cbb23ea0a1a7812ba7e94642f17cd7067dceeb7897da0946940cb336
                                                                • Instruction Fuzzy Hash: F6018933A0562066EAE46334A849B7E67495BC3778F390319F8048B1D3DEBCCC81C192
                                                                Function 00781310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __Init_thread_footer.LIBCMT ref: 007817F6
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Init_thread_footer
                                                                • String ID: CALL
                                                                • API String ID: 1385522511-4196123274
                                                                • Opcode ID: f942a97e8e67d5fea029ba0b10343afbac979656bb38b8b44d2dbfb234e75967
                                                                • Instruction ID: 5b5ebe2b504d1a7e6e8d5e01511acb0ff4ecdcfc3218dbe586aa9e5e45c85e27
                                                                • Opcode Fuzzy Hash: f942a97e8e67d5fea029ba0b10343afbac979656bb38b8b44d2dbfb234e75967
                                                                • Instruction Fuzzy Hash: 6E229B70608241DFC714EF14C484B2ABBF5BF89314F64896DF49A8B3A1D739E952CB92
                                                                Function 00772DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetOpenFileNameW.COMDLG32(?), ref: 007B2C8C
                                                                  • Part of subcall function 00773AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00773A97,?,?,00772E7F,?,?,?,00000000), ref: 00773AC2
                                                                  • Part of subcall function 00772DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00772DC4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Name$Path$FileFullLongOpen
                                                                • String ID: X
                                                                • API String ID: 779396738-3081909835
                                                                • Opcode ID: 64025cfa020292e388af977e41b3b9b18e06db28fed2dc0b9d6d12228c4d9ed3
                                                                • Instruction ID: 6956901a8678da0c45c81492da52c10d92f22626828ed4ee762e2b133e2593c6
                                                                • Opcode Fuzzy Hash: 64025cfa020292e388af977e41b3b9b18e06db28fed2dc0b9d6d12228c4d9ed3
                                                                • Instruction Fuzzy Hash: AD219671A00258AFDF41DF94C8497EE7BF8AF49304F108059E519E7242DBBC5A49CFA1
                                                                Function 00773837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00773908
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: IconNotifyShell_
                                                                • String ID:
                                                                • API String ID: 1144537725-0
                                                                • Opcode ID: 8a5ae637cb9f6dd447cec89fb20ec4e77fde0ade2c20cc102ebb193dacad2a8c
                                                                • Instruction ID: 27796081fbed012f967c87d7fbb697cd61451631a5f1bb5cc7248fe868c32a4d
                                                                • Opcode Fuzzy Hash: 8a5ae637cb9f6dd447cec89fb20ec4e77fde0ade2c20cc102ebb193dacad2a8c
                                                                • Instruction Fuzzy Hash: 4D319170504701DFDB20DF24D889B97BBE8FB49748F00092EF59983340E779AA84DB52
                                                                Function 00774ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00774E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00774EDD,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774E9C
                                                                  • Part of subcall function 00774E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00774EAE
                                                                  • Part of subcall function 00774E90: FreeLibrary.KERNEL32(00000000,?,?,00774EDD,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774EC0
                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774EFD
                                                                  • Part of subcall function 00774E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,007B3CDE,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774E62
                                                                  • Part of subcall function 00774E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00774E74
                                                                  • Part of subcall function 00774E59: FreeLibrary.KERNEL32(00000000,?,?,007B3CDE,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774E87
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Library$Load$AddressFreeProc
                                                                • String ID:
                                                                • API String ID: 2632591731-0
                                                                • Opcode ID: c68454c88933c01f53e9312178b74f3c7d34d5518990e9237908b5ebd4f8ab42
                                                                • Instruction ID: fa43e3570ee256d36b626ff4c64104ceee6a00083441042bee2c569c0983302d
                                                                • Opcode Fuzzy Hash: c68454c88933c01f53e9312178b74f3c7d34d5518990e9237908b5ebd4f8ab42
                                                                • Instruction Fuzzy Hash: AB11E332600205EBDF24FF60DC0AFAD77A5AF40790F10C42DF54AA61C1EFB89A459750
                                                                Function 007A8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: __wsopen_s
                                                                • String ID:
                                                                • API String ID: 3347428461-0
                                                                • Opcode ID: 6c36f8dbf7f239aefb384a2e57d3f23275f03ae44e3e09aa3cd12d5540f9a315
                                                                • Instruction ID: c800806eaabffa8699e86dbfa8868b28a66bf8fc5186d8b3ee4ebf9a6589bcf1
                                                                • Opcode Fuzzy Hash: 6c36f8dbf7f239aefb384a2e57d3f23275f03ae44e3e09aa3cd12d5540f9a315
                                                                • Instruction Fuzzy Hash: 3811187590420AAFCB05DF58E94599B7BF9EF49314F104159F808AB312DA31EA11CBA5
                                                                Function 007A5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007A4C7D: RtlAllocateHeap.NTDLL(00000008,00771129,00000000,?,007A2E29,00000001,00000364,?,?,?,0079F2DE,007A3863,00841444,?,0078FDF5,?), ref: 007A4CBE
                                                                • _free.LIBCMT ref: 007A506C
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AllocateHeap_free
                                                                • String ID:
                                                                • API String ID: 614378929-0
                                                                • Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                • Instruction ID: e4cb17f3c06a4ddde0cde58623d70e90ada3ff7049099e7f3f6e4a63f26c7ce1
                                                                • Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                • Instruction Fuzzy Hash: B0012672204704ABE3218F699885A5BFBE8FBCA370F25071DE18493280EA74A805C6B4
                                                                Function 0079E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                • Instruction ID: d90a8415707dc27db12168e20024d489030889cf2992ae3e6fcbf661123af464
                                                                • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                • Instruction Fuzzy Hash: 8BF0A932511E14EADE317A69AC09B5B33989FD3335F100715F525962D2DB7CE8028AA6
                                                                Function 007A4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • RtlAllocateHeap.NTDLL(00000008,00771129,00000000,?,007A2E29,00000001,00000364,?,?,?,0079F2DE,007A3863,00841444,?,0078FDF5,?), ref: 007A4CBE
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AllocateHeap
                                                                • String ID:
                                                                • API String ID: 1279760036-0
                                                                • Opcode ID: 609b111b8380d14a2c333b553f928da51d6f076430a83f9d6fb17cc007901a59
                                                                • Instruction ID: 893444c4ec23d70eb048be162c0ba246903bf56b1b356086916fa1c8ab00bdb9
                                                                • Opcode Fuzzy Hash: 609b111b8380d14a2c333b553f928da51d6f076430a83f9d6fb17cc007901a59
                                                                • Instruction Fuzzy Hash: FAF0BB32606124A6DF215F619C09F5A3749BFC3770B144311B81D96181DAFAD80146B0
                                                                Function 007A3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • RtlAllocateHeap.NTDLL(00000000,?,00841444,?,0078FDF5,?,?,0077A976,00000010,00841440,007713FC,?,007713C6,?,00771129), ref: 007A3852
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AllocateHeap
                                                                • String ID:
                                                                • API String ID: 1279760036-0
                                                                • Opcode ID: 99807f7a31395ee0286ea8dd7813a9a832993e00c94b2d9b1f0c25f4444dd32f
                                                                • Instruction ID: aa7b2d43432d4670193735ed5150aaff6971e8324b8db0ba5a691f42a0f4d766
                                                                • Opcode Fuzzy Hash: 99807f7a31395ee0286ea8dd7813a9a832993e00c94b2d9b1f0c25f4444dd32f
                                                                • Instruction Fuzzy Hash: 04E065325012259AEB212F66AC09F9A3659AFC37B0F150322BC1596591DB1DDD0182F1
                                                                Function 00774F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FreeLibrary.KERNEL32(?,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774F6D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FreeLibrary
                                                                • String ID:
                                                                • API String ID: 3664257935-0
                                                                • Opcode ID: 986413d1ee4182c0afe29ab3854cd3e208ae498f13d35e3b08ae5ed90533c57b
                                                                • Instruction ID: 7b1688d0ae0af409a89f8e324b66c5a15e17dc4a64027142479fe3df4c4a8d51
                                                                • Opcode Fuzzy Hash: 986413d1ee4182c0afe29ab3854cd3e208ae498f13d35e3b08ae5ed90533c57b
                                                                • Instruction Fuzzy Hash: BDF01571206752DFDF349F64E494822BBE4AF15369328CA7EE1EE82621C73A9844DB10
                                                                Function 007730F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • Shell_NotifyIconW.SHELL32(00000002,?), ref: 0077314E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: IconNotifyShell_
                                                                • String ID:
                                                                • API String ID: 1144537725-0
                                                                • Opcode ID: 6c26579d8fac0f360e8fbc4d539e6e33f560490b1ea9f302a571f15827071944
                                                                • Instruction ID: 34353f22648dcf6c3d10de7065c3aaa1d39b0ab2dc79027a2552f5c94934fb09
                                                                • Opcode Fuzzy Hash: 6c26579d8fac0f360e8fbc4d539e6e33f560490b1ea9f302a571f15827071944
                                                                • Instruction Fuzzy Hash: 07F037749143189FEF629F24DC497D57BFCB701708F0001E5A54896292D77857C8CF51
                                                                Function 00772DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00772DC4
                                                                  • Part of subcall function 00776B57: _wcslen.LIBCMT ref: 00776B6A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: LongNamePath_wcslen
                                                                • String ID:
                                                                • API String ID: 541455249-0
                                                                • Opcode ID: 091780d7a1c34290fd5313ad9516adbdb0cc7e231ac62f4f13f00664e64b34ad
                                                                • Instruction ID: 2116da7c1150b5cd3602bd1fd74e02fffae518504655203ecc2ff63900a27c4f
                                                                • Opcode Fuzzy Hash: 091780d7a1c34290fd5313ad9516adbdb0cc7e231ac62f4f13f00664e64b34ad
                                                                • Instruction Fuzzy Hash: C3E0CD726001245BCB1097589C09FEA77DDDFC87D0F044171FD09D725DDA64AD80C550
                                                                Function 00772B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00773837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00773908
                                                                  • Part of subcall function 0077D730: GetInputState.USER32 ref: 0077D807
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00772B6B
                                                                  • Part of subcall function 007730F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0077314E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: IconNotifyShell_$CurrentDirectoryInputState
                                                                • String ID:
                                                                • API String ID: 3667716007-0
                                                                • Opcode ID: 3035251676e52f9e2216941c49d29b1b8709b49cf0025e53f01d4daeb1aa280b
                                                                • Instruction ID: 33496e70b61ee0212e69db35641b166c7828ed22ac8afbcb4038daeed1ddbdef
                                                                • Opcode Fuzzy Hash: 3035251676e52f9e2216941c49d29b1b8709b49cf0025e53f01d4daeb1aa280b
                                                                • Instruction Fuzzy Hash: B3E0862130424886CE18BB75985E56DA75AABD23D5F40953EF14A831A3DF2D498A8252
                                                                Function 007B039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateFileW.KERNEL32(00000000,00000000,?,007B0704,?,?,00000000,?,007B0704,00000000,0000000C), ref: 007B03B7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateFile
                                                                • String ID:
                                                                • API String ID: 823142352-0
                                                                • Opcode ID: 5608d17db90dd6c1ac2d4240987114979d1103fafd02f0de20ec89d85c4744f3
                                                                • Instruction ID: b4d63ff287a49c7624a510de3b01ecc5cd6c80a6a04995ba8f8095f15ac35792
                                                                • Opcode Fuzzy Hash: 5608d17db90dd6c1ac2d4240987114979d1103fafd02f0de20ec89d85c4744f3
                                                                • Instruction Fuzzy Hash: 51D06C3204010DBBDF028F84DD06EDA3BAAFB48714F014100BE1856020C732E821AB90
                                                                Function 00771CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00771CBC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: InfoParametersSystem
                                                                • String ID:
                                                                • API String ID: 3098949447-0
                                                                • Opcode ID: 5ede57056cf2228f8891164fceacc934c81949a9ad052374cf6ac03184f1971f
                                                                • Instruction ID: 6b07b93006cb60d6e9cbc6af98cdbf7e3b0d2cd699968b1f5e8c1eec591e9e5a
                                                                • Opcode Fuzzy Hash: 5ede57056cf2228f8891164fceacc934c81949a9ad052374cf6ac03184f1971f
                                                                • Instruction Fuzzy Hash: 08C0923E280304AFF6648F80BC4EF10B7A4B349F04F448101F609A96E3C3A22860EA50

                                                                Non-executed Functions

                                                                Function 00809576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0080961A
                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0080965B
                                                                • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0080969F
                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 008096C9
                                                                • SendMessageW.USER32 ref: 008096F2
                                                                • GetKeyState.USER32(00000011), ref: 0080978B
                                                                • GetKeyState.USER32(00000009), ref: 00809798
                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 008097AE
                                                                • GetKeyState.USER32(00000010), ref: 008097B8
                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 008097E9
                                                                • SendMessageW.USER32 ref: 00809810
                                                                • SendMessageW.USER32(?,00001030,?,00807E95), ref: 00809918
                                                                • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0080992E
                                                                • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00809941
                                                                • SetCapture.USER32(?), ref: 0080994A
                                                                • ClientToScreen.USER32(?,?), ref: 008099AF
                                                                • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 008099BC
                                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008099D6
                                                                • ReleaseCapture.USER32 ref: 008099E1
                                                                • GetCursorPos.USER32(?), ref: 00809A19
                                                                • ScreenToClient.USER32(?,?), ref: 00809A26
                                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00809A80
                                                                • SendMessageW.USER32 ref: 00809AAE
                                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00809AEB
                                                                • SendMessageW.USER32 ref: 00809B1A
                                                                • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00809B3B
                                                                • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00809B4A
                                                                • GetCursorPos.USER32(?), ref: 00809B68
                                                                • ScreenToClient.USER32(?,?), ref: 00809B75
                                                                • GetParent.USER32(?), ref: 00809B93
                                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00809BFA
                                                                • SendMessageW.USER32 ref: 00809C2B
                                                                • ClientToScreen.USER32(?,?), ref: 00809C84
                                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00809CB4
                                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00809CDE
                                                                • SendMessageW.USER32 ref: 00809D01
                                                                • ClientToScreen.USER32(?,?), ref: 00809D4E
                                                                • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00809D82
                                                                  • Part of subcall function 00789944: GetWindowLongW.USER32(?,000000EB), ref: 00789952
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00809E05
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                                • String ID: @GUI_DRAGID$F
                                                                • API String ID: 3429851547-4164748364
                                                                • Opcode ID: 31f7c8bf63c45681e814dc29e7b81ffef36b2592576bcf77a7309792bd6594ff
                                                                • Instruction ID: 64537cbf6201f95d7ec0923d16be9893de26b924ce2780610f58c9b1818d92fc
                                                                • Opcode Fuzzy Hash: 31f7c8bf63c45681e814dc29e7b81ffef36b2592576bcf77a7309792bd6594ff
                                                                • Instruction Fuzzy Hash: 0742AE35608201AFDBA0CF64CC48AAABBE5FF59314F14461DF6A9C72E2D732E850CB51
                                                                Function 00804873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 008048F3
                                                                • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00804908
                                                                • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00804927
                                                                • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0080494B
                                                                • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0080495C
                                                                • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0080497B
                                                                • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 008049AE
                                                                • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 008049D4
                                                                • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00804A0F
                                                                • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00804A56
                                                                • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00804A7E
                                                                • IsMenu.USER32(?), ref: 00804A97
                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00804AF2
                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00804B20
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00804B94
                                                                • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00804BE3
                                                                • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00804C82
                                                                • wsprintfW.USER32 ref: 00804CAE
                                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00804CC9
                                                                • GetWindowTextW.USER32(?,00000000,00000001), ref: 00804CF1
                                                                • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00804D13
                                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00804D33
                                                                • GetWindowTextW.USER32(?,00000000,00000001), ref: 00804D5A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                                                • String ID: %d/%02d/%02d
                                                                • API String ID: 4054740463-328681919
                                                                • Opcode ID: ba982f5336b965fc6094225ad5b8c3045093295f782b6a5202e500b064d5174b
                                                                • Instruction ID: 2ff6f198f0e1b468152af08236ed8725d2a7c34d91ffcadee69d57d9d936f4a9
                                                                • Opcode Fuzzy Hash: ba982f5336b965fc6094225ad5b8c3045093295f782b6a5202e500b064d5174b
                                                                • Instruction Fuzzy Hash: 551213B1680219ABEBA49F24CC49FAE7BF8FF45310F105229F615DB2E1DB749941CB50
                                                                Function 0078F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0078F998
                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007CF474
                                                                • IsIconic.USER32(00000000), ref: 007CF47D
                                                                • ShowWindow.USER32(00000000,00000009), ref: 007CF48A
                                                                • SetForegroundWindow.USER32(00000000), ref: 007CF494
                                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 007CF4AA
                                                                • GetCurrentThreadId.KERNEL32 ref: 007CF4B1
                                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 007CF4BD
                                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 007CF4CE
                                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 007CF4D6
                                                                • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 007CF4DE
                                                                • SetForegroundWindow.USER32(00000000), ref: 007CF4E1
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 007CF4F6
                                                                • keybd_event.USER32(00000012,00000000), ref: 007CF501
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 007CF50B
                                                                • keybd_event.USER32(00000012,00000000), ref: 007CF510
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 007CF519
                                                                • keybd_event.USER32(00000012,00000000), ref: 007CF51E
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 007CF528
                                                                • keybd_event.USER32(00000012,00000000), ref: 007CF52D
                                                                • SetForegroundWindow.USER32(00000000), ref: 007CF530
                                                                • AttachThreadInput.USER32(?,000000FF,00000000), ref: 007CF557
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                • String ID: Shell_TrayWnd
                                                                • API String ID: 4125248594-2988720461
                                                                • Opcode ID: 1d8ae6a31ead2f6ab2fce3aa3e8c2336b705d2c99f2a308cc00ef735f1cb08fb
                                                                • Instruction ID: 69f3638d5fea478e5f55598a24c502b97196621edebff8fa678855974da24aa1
                                                                • Opcode Fuzzy Hash: 1d8ae6a31ead2f6ab2fce3aa3e8c2336b705d2c99f2a308cc00ef735f1cb08fb
                                                                • Instruction Fuzzy Hash: 4F314F71A40218BBEB216FB55C4AFBF7E6DFB44B50F10016AFA01E61D1C7B55D10AAA0
                                                                Function 007D1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007D170D
                                                                  • Part of subcall function 007D16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007D173A
                                                                  • Part of subcall function 007D16C3: GetLastError.KERNEL32 ref: 007D174A
                                                                • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 007D1286
                                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 007D12A8
                                                                • CloseHandle.KERNEL32(?), ref: 007D12B9
                                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007D12D1
                                                                • GetProcessWindowStation.USER32 ref: 007D12EA
                                                                • SetProcessWindowStation.USER32(00000000), ref: 007D12F4
                                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 007D1310
                                                                  • Part of subcall function 007D10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007D11FC), ref: 007D10D4
                                                                  • Part of subcall function 007D10BF: CloseHandle.KERNEL32(?,?,007D11FC), ref: 007D10E9
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                                • String ID: $default$winsta0
                                                                • API String ID: 22674027-1027155976
                                                                • Opcode ID: 58b8e62f082a91e0058936e19c1a8dc92e8c88a5ceb00831ae3e2bcbb5223f44
                                                                • Instruction ID: 297f7fb7a4028840fbdff9cdf3c998f4e21b46beaaae3a3c84c753fd416772ab
                                                                • Opcode Fuzzy Hash: 58b8e62f082a91e0058936e19c1a8dc92e8c88a5ceb00831ae3e2bcbb5223f44
                                                                • Instruction Fuzzy Hash: 32818BB1A00249BFDF219FA4DC49FEE7BB9FF04704F14422AF910A62A0D7799945CB60
                                                                Function 007D0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 007D1114
                                                                  • Part of subcall function 007D10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D1120
                                                                  • Part of subcall function 007D10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D112F
                                                                  • Part of subcall function 007D10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D1136
                                                                  • Part of subcall function 007D10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 007D114D
                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 007D0BCC
                                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 007D0C00
                                                                • GetLengthSid.ADVAPI32(?), ref: 007D0C17
                                                                • GetAce.ADVAPI32(?,00000000,?), ref: 007D0C51
                                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007D0C6D
                                                                • GetLengthSid.ADVAPI32(?), ref: 007D0C84
                                                                • GetProcessHeap.KERNEL32(00000008,00000008), ref: 007D0C8C
                                                                • HeapAlloc.KERNEL32(00000000), ref: 007D0C93
                                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 007D0CB4
                                                                • CopySid.ADVAPI32(00000000), ref: 007D0CBB
                                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 007D0CEA
                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007D0D0C
                                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 007D0D1E
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 007D0D45
                                                                • HeapFree.KERNEL32(00000000), ref: 007D0D4C
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 007D0D55
                                                                • HeapFree.KERNEL32(00000000), ref: 007D0D5C
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 007D0D65
                                                                • HeapFree.KERNEL32(00000000), ref: 007D0D6C
                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 007D0D78
                                                                • HeapFree.KERNEL32(00000000), ref: 007D0D7F
                                                                  • Part of subcall function 007D1193: GetProcessHeap.KERNEL32(00000008,007D0BB1,?,00000000,?,007D0BB1,?), ref: 007D11A1
                                                                  • Part of subcall function 007D1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,007D0BB1,?), ref: 007D11A8
                                                                  • Part of subcall function 007D1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,007D0BB1,?), ref: 007D11B7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                • String ID:
                                                                • API String ID: 4175595110-0
                                                                • Opcode ID: 2d5b679228e89cade6d17321cc467e6c886d18ad576de5fd01a687ffd638e2f2
                                                                • Instruction ID: 2503730ad2c31942922009e262856142234bf3662b41b7dce6248575a332de88
                                                                • Opcode Fuzzy Hash: 2d5b679228e89cade6d17321cc467e6c886d18ad576de5fd01a687ffd638e2f2
                                                                • Instruction Fuzzy Hash: 2F714C76A0020AAFDF10DFA4DC48FEEBBB9BF05310F144616F915A7291D779A905CBA0
                                                                Function 007EEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • OpenClipboard.USER32(0080CC08), ref: 007EEB29
                                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 007EEB37
                                                                • GetClipboardData.USER32(0000000D), ref: 007EEB43
                                                                • CloseClipboard.USER32 ref: 007EEB4F
                                                                • GlobalLock.KERNEL32(00000000), ref: 007EEB87
                                                                • CloseClipboard.USER32 ref: 007EEB91
                                                                • GlobalUnlock.KERNEL32(00000000,00000000), ref: 007EEBBC
                                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 007EEBC9
                                                                • GetClipboardData.USER32(00000001), ref: 007EEBD1
                                                                • GlobalLock.KERNEL32(00000000), ref: 007EEBE2
                                                                • GlobalUnlock.KERNEL32(00000000,?), ref: 007EEC22
                                                                • IsClipboardFormatAvailable.USER32(0000000F), ref: 007EEC38
                                                                • GetClipboardData.USER32(0000000F), ref: 007EEC44
                                                                • GlobalLock.KERNEL32(00000000), ref: 007EEC55
                                                                • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 007EEC77
                                                                • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 007EEC94
                                                                • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 007EECD2
                                                                • GlobalUnlock.KERNEL32(00000000,?,?), ref: 007EECF3
                                                                • CountClipboardFormats.USER32 ref: 007EED14
                                                                • CloseClipboard.USER32 ref: 007EED59
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                                • String ID:
                                                                • API String ID: 420908878-0
                                                                • Opcode ID: 3c9378e7130fac33c411bcdb8c536647940dfaa68e1115f1d0aa7a696aca7870
                                                                • Instruction ID: 86bc5810da606049dfc1881f6f5a61b1ebcf027cfd13fb521656e6a4c5c17645
                                                                • Opcode Fuzzy Hash: 3c9378e7130fac33c411bcdb8c536647940dfaa68e1115f1d0aa7a696aca7870
                                                                • Instruction Fuzzy Hash: 7461F074205341AFD710EF25DC89F2AB7A4BF88744F148A1DF45A872A2DB39ED05CB62
                                                                Function 007E698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 007E69BE
                                                                • FindClose.KERNEL32(00000000), ref: 007E6A12
                                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007E6A4E
                                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007E6A75
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 007E6AB2
                                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 007E6ADF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                                • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                                • API String ID: 3830820486-3289030164
                                                                • Opcode ID: 89592b53897ef879106d5f71855e86454a58bdeaa7a8eb451db4d9102b8c639c
                                                                • Instruction ID: 51a7d1fe8ef76495d473138df2853c1cb463a0cc4c07476aa1c5137122db346b
                                                                • Opcode Fuzzy Hash: 89592b53897ef879106d5f71855e86454a58bdeaa7a8eb451db4d9102b8c639c
                                                                • Instruction Fuzzy Hash: 2ED161B2508340AFC714EB64CC85EABB7ECBF99744F04891DF589D6191EB38DA04CB62
                                                                Function 007E9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 007E9663
                                                                • GetFileAttributesW.KERNEL32(?), ref: 007E96A1
                                                                • SetFileAttributesW.KERNEL32(?,?), ref: 007E96BB
                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 007E96D3
                                                                • FindClose.KERNEL32(00000000), ref: 007E96DE
                                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 007E96FA
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 007E974A
                                                                • SetCurrentDirectoryW.KERNEL32(00836B7C), ref: 007E9768
                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 007E9772
                                                                • FindClose.KERNEL32(00000000), ref: 007E977F
                                                                • FindClose.KERNEL32(00000000), ref: 007E978F
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                • String ID: *.*
                                                                • API String ID: 1409584000-438819550
                                                                • Opcode ID: 763c19ea1f653cc3fe3fbaffa820f38d38b083d2d6df101e382253d96a9721af
                                                                • Instruction ID: cc76a0017aa4ff239f687d1a02a8a4283a05a2b440231b83de08c080f8424143
                                                                • Opcode Fuzzy Hash: 763c19ea1f653cc3fe3fbaffa820f38d38b083d2d6df101e382253d96a9721af
                                                                • Instruction Fuzzy Hash: CC31C233502259AADF20AFB5EC49ADE77ACBF4D360F104166FA15E2191EB38DD448A50
                                                                Function 007E979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 007E97BE
                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 007E9819
                                                                • FindClose.KERNEL32(00000000), ref: 007E9824
                                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 007E9840
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 007E9890
                                                                • SetCurrentDirectoryW.KERNEL32(00836B7C), ref: 007E98AE
                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 007E98B8
                                                                • FindClose.KERNEL32(00000000), ref: 007E98C5
                                                                • FindClose.KERNEL32(00000000), ref: 007E98D5
                                                                  • Part of subcall function 007DDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 007DDB00
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                • String ID: *.*
                                                                • API String ID: 2640511053-438819550
                                                                • Opcode ID: b5d461451ae65fede9b6ed3f639551b5088f04226188922b7f74601ed8d41c13
                                                                • Instruction ID: 2e932d6af487681699480180278506a32fa1926452efb6610512b24a922a967f
                                                                • Opcode Fuzzy Hash: b5d461451ae65fede9b6ed3f639551b5088f04226188922b7f74601ed8d41c13
                                                                • Instruction Fuzzy Hash: 0231C332501259AADF20AFB5EC48ADE77ACFF4A320F108155EA10E21E1EB39DD458B60
                                                                Function 007FBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007FC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007FB6AE,?,?), ref: 007FC9B5
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FC9F1
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FCA68
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FCA9E
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007FBF3E
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 007FBFA9
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 007FBFCD
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 007FC02C
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007FC0E7
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 007FC154
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 007FC1E9
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 007FC23A
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 007FC2E3
                                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 007FC382
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 007FC38F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                                • String ID:
                                                                • API String ID: 3102970594-0
                                                                • Opcode ID: 3d9f93af4b9354f655cb0b84f04b1af769c59e7831192b61ce1aec663189fe50
                                                                • Instruction ID: 099db91ab0e01c46b3254c820bfefdb38576e2e09b03fab9c601835e870b87c7
                                                                • Opcode Fuzzy Hash: 3d9f93af4b9354f655cb0b84f04b1af769c59e7831192b61ce1aec663189fe50
                                                                • Instruction Fuzzy Hash: 48026B70604204DFDB15DF24C985E2ABBE5AF89348F18C49CF94A8B3A2DB35EC45CB52
                                                                Function 007E8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLocalTime.KERNEL32(?), ref: 007E8257
                                                                • SystemTimeToFileTime.KERNEL32(?,?), ref: 007E8267
                                                                • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 007E8273
                                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007E8310
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 007E8324
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 007E8356
                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 007E838C
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 007E8395
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CurrentDirectoryTime$File$Local$System
                                                                • String ID: *.*
                                                                • API String ID: 1464919966-438819550
                                                                • Opcode ID: 796fdfcff8525e47f78b30f12535556afeb02742fa601c711aaa5094623918a2
                                                                • Instruction ID: fec187d87e2e95275416d4a1a441fde0099fc6c3c242c4aca4187a1f635e769f
                                                                • Opcode Fuzzy Hash: 796fdfcff8525e47f78b30f12535556afeb02742fa601c711aaa5094623918a2
                                                                • Instruction Fuzzy Hash: C26189B25043459FCB10EF64C8459AEB3E8FF89314F04892EF99997251EB39E905CB92
                                                                Function 007DD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00773AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00773A97,?,?,00772E7F,?,?,?,00000000), ref: 00773AC2
                                                                  • Part of subcall function 007DE199: GetFileAttributesW.KERNEL32(?,007DCF95), ref: 007DE19A
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 007DD122
                                                                • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 007DD1DD
                                                                • MoveFileW.KERNEL32(?,?), ref: 007DD1F0
                                                                • DeleteFileW.KERNEL32(?,?,?,?), ref: 007DD20D
                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 007DD237
                                                                  • Part of subcall function 007DD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,007DD21C,?,?), ref: 007DD2B2
                                                                • FindClose.KERNEL32(00000000,?,?,?), ref: 007DD253
                                                                • FindClose.KERNEL32(00000000), ref: 007DD264
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                                • String ID: \*.*
                                                                • API String ID: 1946585618-1173974218
                                                                • Opcode ID: bb72bc138fd33f63f2390399b29dfb2a4293c3d5e9e90df7bc458670f5034659
                                                                • Instruction ID: f3c0802dbcd4b2c42183660b012f3e9a8021277171ae1253e2e093e210712990
                                                                • Opcode Fuzzy Hash: bb72bc138fd33f63f2390399b29dfb2a4293c3d5e9e90df7bc458670f5034659
                                                                • Instruction Fuzzy Hash: BD617A3180110DEACF15EBE0CE969EDB7B5BF55340F208166E40677292EB39AF09CB61
                                                                Function 007EED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                • String ID:
                                                                • API String ID: 1737998785-0
                                                                • Opcode ID: de33e5c5ec4bbdf3f9f2feae6ad852114a9528e9873ed5c9c70c87a214a91c78
                                                                • Instruction ID: e63760534136eb5d7c10ce8a77f65d31d760ff2d90f5f164b6968d3be3c30789
                                                                • Opcode Fuzzy Hash: de33e5c5ec4bbdf3f9f2feae6ad852114a9528e9873ed5c9c70c87a214a91c78
                                                                • Instruction Fuzzy Hash: EB41AD35605651AFE720DF16D888B19BBE1FF49328F14C59DE4298B7A2C73AEC41CB90
                                                                Function 007DE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007D170D
                                                                  • Part of subcall function 007D16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007D173A
                                                                  • Part of subcall function 007D16C3: GetLastError.KERNEL32 ref: 007D174A
                                                                • ExitWindowsEx.USER32(?,00000000), ref: 007DE932
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                • String ID: $ $@$SeShutdownPrivilege
                                                                • API String ID: 2234035333-3163812486
                                                                • Opcode ID: c4b712ee22ab0e20a2d6c5edd98da93ab36a173f0cfda5cb361b321f8f2771b5
                                                                • Instruction ID: b0d9b5910ddca9bb9106dd8409d7cc0b15386ac5da7363174e82bc49504f7381
                                                                • Opcode Fuzzy Hash: c4b712ee22ab0e20a2d6c5edd98da93ab36a173f0cfda5cb361b321f8f2771b5
                                                                • Instruction Fuzzy Hash: DB014972611211FBEB5537B49C9AFBF72BCAB04740F150923FC13E63D1D6A86C408191
                                                                Function 007F1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 007F1276
                                                                • WSAGetLastError.WSOCK32 ref: 007F1283
                                                                • bind.WSOCK32(00000000,?,00000010), ref: 007F12BA
                                                                • WSAGetLastError.WSOCK32 ref: 007F12C5
                                                                • closesocket.WSOCK32(00000000), ref: 007F12F4
                                                                • listen.WSOCK32(00000000,00000005), ref: 007F1303
                                                                • WSAGetLastError.WSOCK32 ref: 007F130D
                                                                • closesocket.WSOCK32(00000000), ref: 007F133C
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$closesocket$bindlistensocket
                                                                • String ID:
                                                                • API String ID: 540024437-0
                                                                • Opcode ID: cb63b11330213168565563b9dcdbf3419caee956ef817add763f867068eaf866
                                                                • Instruction ID: 91026d9904a340cfdd18b1ebc3e43969ba2f30b4d2292eb0819f4a6353e38505
                                                                • Opcode Fuzzy Hash: cb63b11330213168565563b9dcdbf3419caee956ef817add763f867068eaf866
                                                                • Instruction Fuzzy Hash: 55417E31A00144DFD710DF68C488B2ABBE6BF4A318F58C198E9569F392C775ED81CBA1
                                                                Function 007AB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • _free.LIBCMT ref: 007AB9D4
                                                                • _free.LIBCMT ref: 007AB9F8
                                                                • _free.LIBCMT ref: 007ABB7F
                                                                • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00813700), ref: 007ABB91
                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,0084121C,000000FF,00000000,0000003F,00000000,?,?), ref: 007ABC09
                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00841270,000000FF,?,0000003F,00000000,?), ref: 007ABC36
                                                                • _free.LIBCMT ref: 007ABD4B
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                                • String ID:
                                                                • API String ID: 314583886-0
                                                                • Opcode ID: 97d7c73a8afaf28ae423c33f415d9df8cdde0aa7e4e06d9214ed1b10099341d6
                                                                • Instruction ID: 73934d11de65d92e185a97db2f5a6f1e287e54c762a382b1d62f7814dc3f5799
                                                                • Opcode Fuzzy Hash: 97d7c73a8afaf28ae423c33f415d9df8cdde0aa7e4e06d9214ed1b10099341d6
                                                                • Instruction Fuzzy Hash: 21C10571A04244EFDB20DF689C45BAABBA9EFC3310F14439AE595D7253E7389E41CB60
                                                                Function 007DD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00773AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00773A97,?,?,00772E7F,?,?,?,00000000), ref: 00773AC2
                                                                  • Part of subcall function 007DE199: GetFileAttributesW.KERNEL32(?,007DCF95), ref: 007DE19A
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 007DD420
                                                                • DeleteFileW.KERNEL32(?,?,?,?), ref: 007DD470
                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 007DD481
                                                                • FindClose.KERNEL32(00000000), ref: 007DD498
                                                                • FindClose.KERNEL32(00000000), ref: 007DD4A1
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                • String ID: \*.*
                                                                • API String ID: 2649000838-1173974218
                                                                • Opcode ID: 1a0467ce31bab99a367ebb16e91ecdef9e66d73a4d9d30595f46a79f1bdf572b
                                                                • Instruction ID: 11526f727a4b8e9c22487943f2cf9f4046ed5cc4a2ce84b768f329768eff2cb8
                                                                • Opcode Fuzzy Hash: 1a0467ce31bab99a367ebb16e91ecdef9e66d73a4d9d30595f46a79f1bdf572b
                                                                • Instruction Fuzzy Hash: 98317271008385EBC711EF64C8558AFB7A8BE91344F448A1EF8D552291EB28AE09CB63
                                                                Function 007AE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: __floor_pentium4
                                                                • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                • API String ID: 4168288129-2761157908
                                                                • Opcode ID: 33bfe45a3498e2abe06ffe6346a62e5ddeca2353feac05490825f4fac98e2ed1
                                                                • Instruction ID: 32193dfb728ac0464d28c07fa17195057c046f568286918da5913870802bbf65
                                                                • Opcode Fuzzy Hash: 33bfe45a3498e2abe06ffe6346a62e5ddeca2353feac05490825f4fac98e2ed1
                                                                • Instruction Fuzzy Hash: 2FC22B71E046288FDF25CE68DD447EAB7B5EB8A305F1442EAD44DE7241E778AE818F40
                                                                Function 007E648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _wcslen.LIBCMT ref: 007E64DC
                                                                • CoInitialize.OLE32(00000000), ref: 007E6639
                                                                • CoCreateInstance.OLE32(0080FCF8,00000000,00000001,0080FB68,?), ref: 007E6650
                                                                • CoUninitialize.OLE32 ref: 007E68D4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                • String ID: .lnk
                                                                • API String ID: 886957087-24824748
                                                                • Opcode ID: 9ee5c1d9e730c36a2b743653336d36c5ab99c959a62dd8825841a13c8eed18f5
                                                                • Instruction ID: c516a20549b97e52e320ab0f182db08301d96a4d530b278f80e35fc5527735a9
                                                                • Opcode Fuzzy Hash: 9ee5c1d9e730c36a2b743653336d36c5ab99c959a62dd8825841a13c8eed18f5
                                                                • Instruction Fuzzy Hash: 1DD16971608341AFC714DF24C885E6BB7E8FF99744F00892DF5998B2A1EB34E905CB92
                                                                Function 007F22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetForegroundWindow.USER32(?,?,00000000), ref: 007F22E8
                                                                  • Part of subcall function 007EE4EC: GetWindowRect.USER32(?,?), ref: 007EE504
                                                                • GetDesktopWindow.USER32 ref: 007F2312
                                                                • GetWindowRect.USER32(00000000), ref: 007F2319
                                                                • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 007F2355
                                                                • GetCursorPos.USER32(?), ref: 007F2381
                                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007F23DF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                                • String ID:
                                                                • API String ID: 2387181109-0
                                                                • Opcode ID: d48e937bc21c9056e9b23e1169a03b07d834be14906dbfe3efe74dc606575858
                                                                • Instruction ID: 7cc106015b81cebd134179840ef682997a91e78b9428a279b81dcc805bf4c97b
                                                                • Opcode Fuzzy Hash: d48e937bc21c9056e9b23e1169a03b07d834be14906dbfe3efe74dc606575858
                                                                • Instruction Fuzzy Hash: 5431D2B25053199FD720DF54C849F6BBBA9FF84314F000A19F58597291D738E909CB92
                                                                Function 007E9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 007E9B78
                                                                • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 007E9C8B
                                                                  • Part of subcall function 007E3874: GetInputState.USER32 ref: 007E38CB
                                                                  • Part of subcall function 007E3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007E3966
                                                                • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 007E9BA8
                                                                • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 007E9C75
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                                • String ID: *.*
                                                                • API String ID: 1972594611-438819550
                                                                • Opcode ID: ee5cec09c8726f4fe944aba99259a20445969cd113856f11fc003f2ccd5f9b91
                                                                • Instruction ID: c55e3d559e434c641fd6a5142bdd8580abb56d22fed711d98eabcaf09aba98bd
                                                                • Opcode Fuzzy Hash: ee5cec09c8726f4fe944aba99259a20445969cd113856f11fc003f2ccd5f9b91
                                                                • Instruction Fuzzy Hash: 43419372901249EFCF54EF75C849AEEBBB4FF09350F208155E509A21A1EB389E84CF60
                                                                Function 0078997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                • DefDlgProcW.USER32(?,?,?,?,?), ref: 00789A4E
                                                                • GetSysColor.USER32(0000000F), ref: 00789B23
                                                                • SetBkColor.GDI32(?,00000000), ref: 00789B36
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Color$LongProcWindow
                                                                • String ID:
                                                                • API String ID: 3131106179-0
                                                                • Opcode ID: 0c83ffc8de4c5f736a94b6e85e56ae3dddbf25b22987b44d52d18552340eac0d
                                                                • Instruction ID: 0f2ffde5a480ee9936db12ad1da6f424fe3aff49a5132d85cd5e2762690ca30b
                                                                • Opcode Fuzzy Hash: 0c83ffc8de4c5f736a94b6e85e56ae3dddbf25b22987b44d52d18552340eac0d
                                                                • Instruction Fuzzy Hash: 5BA1E970288404BEE72DBA2D8C5DE7B2A9DFB82350B19411DF602D6AD1CE2D9D41C777
                                                                Function 007F1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007F304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 007F307A
                                                                  • Part of subcall function 007F304E: _wcslen.LIBCMT ref: 007F309B
                                                                • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 007F185D
                                                                • WSAGetLastError.WSOCK32 ref: 007F1884
                                                                • bind.WSOCK32(00000000,?,00000010), ref: 007F18DB
                                                                • WSAGetLastError.WSOCK32 ref: 007F18E6
                                                                • closesocket.WSOCK32(00000000), ref: 007F1915
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                                • String ID:
                                                                • API String ID: 1601658205-0
                                                                • Opcode ID: c017e285b6897415edd7fcd5c06ab24b394b0b94d0ebe4984d172c9b7b693877
                                                                • Instruction ID: 13d7210424d786a5be475e111d52e4d1a5427dee88adca2c7ea2b7cfeeb71cda
                                                                • Opcode Fuzzy Hash: c017e285b6897415edd7fcd5c06ab24b394b0b94d0ebe4984d172c9b7b693877
                                                                • Instruction Fuzzy Hash: 1851A171A40200EFDB10AF24C88AF2A77A5AB49758F58C458FA095F383D779AD418BE1
                                                                Function 00801C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                • String ID:
                                                                • API String ID: 292994002-0
                                                                • Opcode ID: ffbbd8ea7ff24cf025c27316e5a57a010d0658624eea86f1a27d9a6a1a4855bd
                                                                • Instruction ID: 7df05fd7a84d7583c9196e4129bf13966c1f2054bae0b7cc482aa04c371b4ed0
                                                                • Opcode Fuzzy Hash: ffbbd8ea7ff24cf025c27316e5a57a010d0658624eea86f1a27d9a6a1a4855bd
                                                                • Instruction Fuzzy Hash: 752174317416119FEB618F2ACC88B5A7BA5FF95325F19805CE846CB291CB75DC42CB90
                                                                Function 00778060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                                • API String ID: 0-1546025612
                                                                • Opcode ID: ce9a5755f9934a1dd6293f1c8c316029e692b9b3b0a8f9cfb2aec64275074357
                                                                • Instruction ID: 7b722643f08cfc26ce529c72a9efd195728d9c774cabfee4f0613edc51f3f499
                                                                • Opcode Fuzzy Hash: ce9a5755f9934a1dd6293f1c8c316029e692b9b3b0a8f9cfb2aec64275074357
                                                                • Instruction Fuzzy Hash: 62A2A170E4021ACBDF64CF58C8447EEB7B1BF54350F2481AAE919A7285EB789D81CF91
                                                                Function 007DAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 007DAAAC
                                                                • SetKeyboardState.USER32(00000080), ref: 007DAAC8
                                                                • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 007DAB36
                                                                • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 007DAB88
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: KeyboardState$InputMessagePostSend
                                                                • String ID:
                                                                • API String ID: 432972143-0
                                                                • Opcode ID: aa56c107e099f6ca41b2db1c46f926cc68c0ba141bf470c0f1a88421b652c1ba
                                                                • Instruction ID: 088aa0571c0ec065cef3e8054150d1879da7bd5128ff43b07525a2438c9cf0a4
                                                                • Opcode Fuzzy Hash: aa56c107e099f6ca41b2db1c46f926cc68c0ba141bf470c0f1a88421b652c1ba
                                                                • Instruction Fuzzy Hash: C931E5B0A40248BEEF358B648C09BFA7BB6BB45310F14431BF591567E1D37D8982C762
                                                                Function 007ECE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetReadFile.WININET(?,?,00000400,?), ref: 007ECE89
                                                                • GetLastError.KERNEL32(?,00000000), ref: 007ECEEA
                                                                • SetEvent.KERNEL32(?,?,00000000), ref: 007ECEFE
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorEventFileInternetLastRead
                                                                • String ID:
                                                                • API String ID: 234945975-0
                                                                • Opcode ID: 507df9e40709e1cbf1b09d7d1693ac41f540452b1e03ac9232cfae1a0b1bee4b
                                                                • Instruction ID: 88516bd38c96d4f60530aa95eb11f9cb23e188cf147d0a1f475d48a2b75c883c
                                                                • Opcode Fuzzy Hash: 507df9e40709e1cbf1b09d7d1693ac41f540452b1e03ac9232cfae1a0b1bee4b
                                                                • Instruction Fuzzy Hash: 7421EDB5501305EFEB31DFA6C949BAA77F8EB04308F10441EE542D2151E778EE068B60
                                                                Function 007D8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • lstrlenW.KERNEL32(?,?,?,00000000), ref: 007D82AA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: lstrlen
                                                                • String ID: ($|
                                                                • API String ID: 1659193697-1631851259
                                                                • Opcode ID: df24e07e3f187d93d71178a692b53298b0708f5eac2be7d8c5dc79030ad011bc
                                                                • Instruction ID: 9a394721710f8011ad78773de3f6a096c76015688b208edf407c70a6bdfaca06
                                                                • Opcode Fuzzy Hash: df24e07e3f187d93d71178a692b53298b0708f5eac2be7d8c5dc79030ad011bc
                                                                • Instruction Fuzzy Hash: 4B323474A00605DFCB68CF59C481A6AB7F0FF48720B15C56EE59ADB3A1EB74E981CB40
                                                                Function 007E5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 007E5CC1
                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 007E5D17
                                                                • FindClose.KERNEL32(?), ref: 007E5D5F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$File$CloseFirstNext
                                                                • String ID:
                                                                • API String ID: 3541575487-0
                                                                • Opcode ID: d96c498d8ffe2b3421274251442edc167946c21fcb96f50cff313e167a12f410
                                                                • Instruction ID: 35e3e070b59b874784e12679afb33cee646d25d14fec2bb47d3636b4a16518c5
                                                                • Opcode Fuzzy Hash: d96c498d8ffe2b3421274251442edc167946c21fcb96f50cff313e167a12f410
                                                                • Instruction Fuzzy Hash: B351BB34700A45DFC714DF28C898A9AB7E4FF49318F14855DE95A8B3A2CB34EC04CB91
                                                                Function 007A2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • IsDebuggerPresent.KERNEL32 ref: 007A271A
                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 007A2724
                                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 007A2731
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                • String ID:
                                                                • API String ID: 3906539128-0
                                                                • Opcode ID: 2fe815d9ace5485f4db4c568e0b10314b5070eb31e5ebc3e9abfb96127098be5
                                                                • Instruction ID: 88aea5a920ed7fd4dcf9bf7df36171613ebe0f99ccf827d4946cadb20cb82316
                                                                • Opcode Fuzzy Hash: 2fe815d9ace5485f4db4c568e0b10314b5070eb31e5ebc3e9abfb96127098be5
                                                                • Instruction Fuzzy Hash: 8D31B574911218ABCB21DF68DD897DDB7B8BF48310F5042EAE81CA7261E7349F818F85
                                                                Function 007E51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetErrorMode.KERNEL32(00000001), ref: 007E51DA
                                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 007E5238
                                                                • SetErrorMode.KERNEL32(00000000), ref: 007E52A1
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$DiskFreeSpace
                                                                • String ID:
                                                                • API String ID: 1682464887-0
                                                                • Opcode ID: eecbe59f8745f6be198b0a71d0a4260cbc43071b882a1b2abb0abdfdbc5f26ef
                                                                • Instruction ID: 19fba6b5f5310e2cabc4c660df82b1e41daa7955fe4480f8dcb78115470dc7ac
                                                                • Opcode Fuzzy Hash: eecbe59f8745f6be198b0a71d0a4260cbc43071b882a1b2abb0abdfdbc5f26ef
                                                                • Instruction Fuzzy Hash: 2E316F75A00518DFDB00DF54D888EADBBB4FF49318F088099E909AB3A2DB75EC55CB90
                                                                Function 007D16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 0078FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00790668
                                                                  • Part of subcall function 0078FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00790685
                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007D170D
                                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007D173A
                                                                • GetLastError.KERNEL32 ref: 007D174A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                                • String ID:
                                                                • API String ID: 577356006-0
                                                                • Opcode ID: 1b661a53df130a775b73bb2068fcf5534da728973876c933286d839115ef8876
                                                                • Instruction ID: 9768d3f498b598904d844bc638a89e57c20c6a8933ed48b6c62e7f8233b7e141
                                                                • Opcode Fuzzy Hash: 1b661a53df130a775b73bb2068fcf5534da728973876c933286d839115ef8876
                                                                • Instruction Fuzzy Hash: 1F11CEB2500304FFE718AF64DC8AD6AB7BDFB04724B20852EE45653251EB74FC418B20
                                                                Function 007DD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007DD608
                                                                • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 007DD645
                                                                • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007DD650
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseControlCreateDeviceFileHandle
                                                                • String ID:
                                                                • API String ID: 33631002-0
                                                                • Opcode ID: c31bfb8189296eefe5013de9839aaf19fe884a1e982656f580255a5d79976d7e
                                                                • Instruction ID: 9ec30f679d8cb9621298e28dbbb4ba91d868d00728c851dd2f971775001fab9a
                                                                • Opcode Fuzzy Hash: c31bfb8189296eefe5013de9839aaf19fe884a1e982656f580255a5d79976d7e
                                                                • Instruction Fuzzy Hash: E8113C75E05228BBDB208F959C45FAFBBBCEB45B50F108156F904E7290D6704A058BA1
                                                                Function 007D1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 007D168C
                                                                • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007D16A1
                                                                • FreeSid.ADVAPI32(?), ref: 007D16B1
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                • String ID:
                                                                • API String ID: 3429775523-0
                                                                • Opcode ID: 132b976d905c7c7d2de28b71a2b3e0fe06504ee5f7f4b9fff2275ec940592dc8
                                                                • Instruction ID: 7ac602e33bc6fc5038912e592f0ecbd422c98b01465d0e14a7f373b2a0f8a79b
                                                                • Opcode Fuzzy Hash: 132b976d905c7c7d2de28b71a2b3e0fe06504ee5f7f4b9fff2275ec940592dc8
                                                                • Instruction Fuzzy Hash: CDF0F471950309FBEB00DFE49D89AAEBBBCFB08604F504565E501E2191E774AA448A50
                                                                Function 007AC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: /
                                                                • API String ID: 0-2043925204
                                                                • Opcode ID: 9c5dc6f1824d5ac62b8b5e7a12df3efeea07b3aeb41c2592e223844047d2d812
                                                                • Instruction ID: 22537eeb16ecb042ea066a865b13b46a38fbfbc840265128ddd70968055b3ac0
                                                                • Opcode Fuzzy Hash: 9c5dc6f1824d5ac62b8b5e7a12df3efeea07b3aeb41c2592e223844047d2d812
                                                                • Instruction Fuzzy Hash: A9413676900218BFCB249FB9DC49EBB77B8EBC6314F1047A9F905D7180E6749D818B50
                                                                Function 007CD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetUserNameW.ADVAPI32(?,?), ref: 007CD28C
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: NameUser
                                                                • String ID: X64
                                                                • API String ID: 2645101109-893830106
                                                                • Opcode ID: 4f2dd2382df50f041a3a1e1a99680fdb7db93652cddee2815ad2e8e8e2993acb
                                                                • Instruction ID: c5a18f7d6e471bae7683406e08003868c1686141ff356db6e313305c3c698532
                                                                • Opcode Fuzzy Hash: 4f2dd2382df50f041a3a1e1a99680fdb7db93652cddee2815ad2e8e8e2993acb
                                                                • Instruction Fuzzy Hash: 1DD0C9B480111DEACBA4DB90DC88DD9B37CBB14305F100255F106A2040D77499498F10
                                                                Function 0079CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                • Instruction ID: 54247c3eaf9ff897dccf8c64f75ce06650fb3a71284fb38b300ef02322b9ca39
                                                                • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                • Instruction Fuzzy Hash: C9022D72E002199FDF15CFA9D9806ADFBF2EF48314F258169D919E7380D734AA41CB94
                                                                Function 007E68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 007E6918
                                                                • FindClose.KERNEL32(00000000), ref: 007E6961
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$CloseFileFirst
                                                                • String ID:
                                                                • API String ID: 2295610775-0
                                                                • Opcode ID: b8c400d0cb0d88cebaeaa020ca6bfce528e933ede019c22cff1a236ecabe5e39
                                                                • Instruction ID: 2f0a9e59026c09054a54eb839f3ecd246e0a586f9f04a8f7450144a64e22a9b5
                                                                • Opcode Fuzzy Hash: b8c400d0cb0d88cebaeaa020ca6bfce528e933ede019c22cff1a236ecabe5e39
                                                                • Instruction Fuzzy Hash: E3119071604240DFC710DF2AD488A1ABBE5FF89368F14C69DE4698F6A2C734EC05CB91
                                                                Function 007E37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,007F4891,?,?,00000035,?), ref: 007E37E4
                                                                • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,007F4891,?,?,00000035,?), ref: 007E37F4
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorFormatLastMessage
                                                                • String ID:
                                                                • API String ID: 3479602957-0
                                                                • Opcode ID: 9199f3a3c31bd9c28d160604a76cf5ee810e01c33e26d51cbcf038a7792e5e0e
                                                                • Instruction ID: 407a571b32b112123c05e59cbe824d24369b6c49a421917590e97836f4958578
                                                                • Opcode Fuzzy Hash: 9199f3a3c31bd9c28d160604a76cf5ee810e01c33e26d51cbcf038a7792e5e0e
                                                                • Instruction Fuzzy Hash: F7F0EC706062146ADB5017774C4DFEB369DEFC5761F000265F509D3281D5705904C6B0
                                                                Function 007DB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 007DB25D
                                                                • keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 007DB270
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: InputSendkeybd_event
                                                                • String ID:
                                                                • API String ID: 3536248340-0
                                                                • Opcode ID: 950d3c8c933447bd2fb7ead48fbf3019a12642244d8639e844c75e69ec4abef6
                                                                • Instruction ID: f50181683ae1a591a897f58c0c2af2c72a7f97155275761762028c4ffcddf641
                                                                • Opcode Fuzzy Hash: 950d3c8c933447bd2fb7ead48fbf3019a12642244d8639e844c75e69ec4abef6
                                                                • Instruction Fuzzy Hash: 17F01D7580424DABDB159FA4C805BAE7BB4FF08305F00810AF955A5191C37996119F94
                                                                Function 007D10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007D11FC), ref: 007D10D4
                                                                • CloseHandle.KERNEL32(?,?,007D11FC), ref: 007D10E9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AdjustCloseHandlePrivilegesToken
                                                                • String ID:
                                                                • API String ID: 81990902-0
                                                                • Opcode ID: 15fdedc2d9d41de494fe4d929601cfb42046c4245c23b7d622d88a42b348c170
                                                                • Instruction ID: adcda808a0847f733c3bb81c1ffd09e3615e639bf269af3cb21a142a445511a4
                                                                • Opcode Fuzzy Hash: 15fdedc2d9d41de494fe4d929601cfb42046c4245c23b7d622d88a42b348c170
                                                                • Instruction Fuzzy Hash: 62E04F32014600EEE7252F11FC09E7377A9FB04320B10C92EF5A5805B1DB626CA0DB50
                                                                Function 0077CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                • Variable is not of type 'Object'., xrefs: 007C0C40
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: Variable is not of type 'Object'.
                                                                • API String ID: 0-1840281001
                                                                • Opcode ID: 760a5e9cc2dcad826afe33786a8b0d986dfa94ecfaad3b62664af3c699c7522f
                                                                • Instruction ID: deebdccae55104350cfb2c0d9393a9ad140829d3c8faaef6c5f3e2bbf2f07a37
                                                                • Opcode Fuzzy Hash: 760a5e9cc2dcad826afe33786a8b0d986dfa94ecfaad3b62664af3c699c7522f
                                                                • Instruction Fuzzy Hash: E4328E71A00218DBDF15DF94C885FEDB7B5BF09384F14805DE80AAB292D779AE45CBA0
                                                                Function 007A676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,007A6766,?,?,00000008,?,?,007AFEFE,00000000), ref: 007A6998
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ExceptionRaise
                                                                • String ID:
                                                                • API String ID: 3997070919-0
                                                                • Opcode ID: b402e8b4dbc5fe782faabee3b668a960aee1296c03cb3398db165650e31b8e23
                                                                • Instruction ID: ff9d3c2095d23d0da3bdf40916cf5af39752f9613b1737ddc635224f258be193
                                                                • Opcode Fuzzy Hash: b402e8b4dbc5fe782faabee3b668a960aee1296c03cb3398db165650e31b8e23
                                                                • Instruction Fuzzy Hash: 62B12B71610608DFD715CF28C48AB657BE0FF86364F29C658E899CF2A2C739E991CB40
                                                                Function 0078B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID: 0-3916222277
                                                                • Opcode ID: b0c50d67f4ea1f47d16c4e6cd450b8e51d16f5b259febd754dd60e8656716acf
                                                                • Instruction ID: 6cd5ffb486829c4b9f95af74133d03f9ffa2958cf18072ffae944e25276d10a4
                                                                • Opcode Fuzzy Hash: b0c50d67f4ea1f47d16c4e6cd450b8e51d16f5b259febd754dd60e8656716acf
                                                                • Instruction Fuzzy Hash: 04125071900229DBDB54DF58C881BEEB7B5FF48710F14819AE849EB251EB389E81CB91
                                                                Function 007EEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • BlockInput.USER32(00000001), ref: 007EEABD
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: BlockInput
                                                                • String ID:
                                                                • API String ID: 3456056419-0
                                                                • Opcode ID: 44e1322c73f36061e2ca0c0ee339d5d8c347fdc9f3e4c97136b3a64546e20eed
                                                                • Instruction ID: 74e996d840eb88130fa38242e993d593b01982c045f6910cc197a76ff7a26a7f
                                                                • Opcode Fuzzy Hash: 44e1322c73f36061e2ca0c0ee339d5d8c347fdc9f3e4c97136b3a64546e20eed
                                                                • Instruction Fuzzy Hash: 58E012312002049FC710DF5AD404E9AB7D9AF5D764F00C42AFC49C7251D774A8408B90
                                                                Function 007909D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,007903EE), ref: 007909DA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterUnhandled
                                                                • String ID:
                                                                • API String ID: 3192549508-0
                                                                • Opcode ID: 0d9421b3012b20b8571bbe58977ab34fe9e7ae95151af2f082218ed29fe4a875
                                                                • Instruction ID: 2867f559ad3347b6e0546ba3bc7d93f374d6d91c4688a7b15db93bd91f62d494
                                                                • Opcode Fuzzy Hash: 0d9421b3012b20b8571bbe58977ab34fe9e7ae95151af2f082218ed29fe4a875
                                                                • Instruction Fuzzy Hash:
                                                                Function 0079781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: 0
                                                                • API String ID: 0-4108050209
                                                                • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                • Instruction ID: bbc6717c0279f82ae811f8d9ca7b4640c194556818c7da50703440b58bae0c52
                                                                • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                • Instruction Fuzzy Hash: 4351677163CB059BDF3C8568B89EFBE2399DB12354F180509D886DB382C61DEE42D356
                                                                Function 007A6DD9 Relevance: .6, Instructions: 637COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 7a274c278f6aba9a2d4b853ac854f8c58c1b0b6dfb5bef63429d989dcf980782
                                                                • Instruction ID: c22aa643e5bacfa193eff62276908a1fb77ee72892ea52d7ca9058765ab6ddcc
                                                                • Opcode Fuzzy Hash: 7a274c278f6aba9a2d4b853ac854f8c58c1b0b6dfb5bef63429d989dcf980782
                                                                • Instruction Fuzzy Hash: B1322122D29F414DD7279634DC22336A68DAFF73C5F15D737E81AB59AAEB28C4938100
                                                                Function 0078CC39 Relevance: .6, Instructions: 635COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5256053b0664a88cee0a32f621d63cc6c1ca5eca534bb04926f13aa0bbf63eec
                                                                • Instruction ID: 29ea4fffee971f8fbe7da4bc80971ae97af5c461c628d1c2d294b46dae169347
                                                                • Opcode Fuzzy Hash: 5256053b0664a88cee0a32f621d63cc6c1ca5eca534bb04926f13aa0bbf63eec
                                                                • Instruction Fuzzy Hash: 55320531A001158BDF2ADF28C494F7D7BA1EB45310F28856ED88EDB291E63CDD81DB61
                                                                Function 00777920 Relevance: .6, Instructions: 563COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ed36e35b400525a1afad05ff78a15acba89aa54f6979a4d555d4cfd5b7cc728c
                                                                • Instruction ID: f564e91a36d22469990647e63ff1efdcf5c3fbb9776e140e6d7fd4cc90b3c276
                                                                • Opcode Fuzzy Hash: ed36e35b400525a1afad05ff78a15acba89aa54f6979a4d555d4cfd5b7cc728c
                                                                • Instruction Fuzzy Hash: 7222AFB0A04609DFDF14DF68D885BEEB7F5FF48344F148529E816A7291EB3AA910CB50
                                                                Function 007791C0 Relevance: .5, Instructions: 475COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5421844a2d7926fc1b27b655cd2ee78766e2f820023dfbd46f85f96e5be83c8d
                                                                • Instruction ID: e2518ee70925ade70c242c21e589bcdc286d7220707325bba3c1be7675b8aeb3
                                                                • Opcode Fuzzy Hash: 5421844a2d7926fc1b27b655cd2ee78766e2f820023dfbd46f85f96e5be83c8d
                                                                • Instruction Fuzzy Hash: 2F02A5B1A00105EBDF04DF64D885BEEB7B5FF44340F11C569E91A9B391EB39AA20CB91
                                                                Function 007A9EEE Relevance: .3, Instructions: 294COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5db021306606ce5d0407dca5239d6c589d85dd3078a5d4b93b8e2d1a3b3cc574
                                                                • Instruction ID: 61073412042a7dcf9ea33fbcc705d75f0f1bf5343df2ecee34581cd3a99a5507
                                                                • Opcode Fuzzy Hash: 5db021306606ce5d0407dca5239d6c589d85dd3078a5d4b93b8e2d1a3b3cc574
                                                                • Instruction Fuzzy Hash: D6B1E220D2AF414DD62396399831336FA5CBFBB6D5F51D71BFC2674E22EB2286834240
                                                                Function 00791C77 Relevance: .3, Instructions: 254COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                • Instruction ID: bae471f7b23c86590c4599ef9b8c61b2a467e60d690e75497a711415ec86848b
                                                                • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                • Instruction Fuzzy Hash: F69167722090E34ADF2D463AA57403DFFE15A523B239A079DD4F2CA1C5EE28D974D620
                                                                Function 00791F32 Relevance: .2, Instructions: 244COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                • Instruction ID: 43c517424b5e9dc2af918973723e0c6d5d7b452cea85588fb8c7f406f8da169e
                                                                • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                • Instruction Fuzzy Hash: 8E91A7722090E71ADF6D523D943403EFFE25A923A131A079DD4F2CB1C6EE28D975E620
                                                                Function 007919B0 Relevance: .2, Instructions: 240COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                • Instruction ID: 67c05da60618c2a8819f536cc7e8d3b8c96ee1106dc302923987b0de03127d8e
                                                                • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                • Instruction Fuzzy Hash: D69145722090E34ADF2D467AA57403DFFE19A923B239A479ED4F2CA1C1FD18D974D620
                                                                Function 00797A4A Relevance: .2, Instructions: 237COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: e878ff7ea552e4f3a6ad2fb2728ddd596c7592c16a7059b5417c39ae22242617
                                                                • Instruction ID: 0cb573845e6bdb3e4b02bcc08c2bd3de7182cbf8e5f2dc9cc0f17d4253bdbea7
                                                                • Opcode Fuzzy Hash: e878ff7ea552e4f3a6ad2fb2728ddd596c7592c16a7059b5417c39ae22242617
                                                                • Instruction Fuzzy Hash: 6B615AB123874996DE3C9A2CBC99BBE2399DF42700F14491EE843DB291D61DDE42C366
                                                                Function 00797CA7 Relevance: .2, Instructions: 237COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 21d1cb0ba5612b95c97a191729363db86f2a10cfff42c09ee167d0e4acf5dcc9
                                                                • Instruction ID: bc025f1421aa522eba2931eba4b6303f3bb61638263d75d54842119dd10d4196
                                                                • Opcode Fuzzy Hash: 21d1cb0ba5612b95c97a191729363db86f2a10cfff42c09ee167d0e4acf5dcc9
                                                                • Instruction Fuzzy Hash: 8261697173870997DE3C8A28B896BBF2398EF42704F140959E942DF281DA1EAD42C356
                                                                Function 00791706 Relevance: .2, Instructions: 232COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                • Instruction ID: 7dd0b8290f7901e23f04b3e0d017817e44dc13fd5e36adb60443b68bbc2f87d8
                                                                • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                • Instruction Fuzzy Hash: C08175726090E309DF6D827A953443EFFE15A923B139A079DD4F2CB1C1EE28D574E620
                                                                Function 007E2046 Relevance: .1, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0ea759e5e20309b77f83167937538d89e78c7f138210c37d98eb0e7ce2865dd3
                                                                • Instruction ID: a64c7e88e21904419815aad5a560ceb8907c9396121028336d8d5e71c4f9be7d
                                                                • Opcode Fuzzy Hash: 0ea759e5e20309b77f83167937538d89e78c7f138210c37d98eb0e7ce2865dd3
                                                                • Instruction Fuzzy Hash: 3321A8326216558BDB28CF79C81267A73E9B764310F55862EE4A7C37D1DE39A904CB80
                                                                Function 007F2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DeleteObject.GDI32(00000000), ref: 007F2B30
                                                                • DeleteObject.GDI32(00000000), ref: 007F2B43
                                                                • DestroyWindow.USER32 ref: 007F2B52
                                                                • GetDesktopWindow.USER32 ref: 007F2B6D
                                                                • GetWindowRect.USER32(00000000), ref: 007F2B74
                                                                • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 007F2CA3
                                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 007F2CB1
                                                                • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2CF8
                                                                • GetClientRect.USER32(00000000,?), ref: 007F2D04
                                                                • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 007F2D40
                                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2D62
                                                                • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2D75
                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2D80
                                                                • GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2D89
                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2D98
                                                                • GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2DA1
                                                                • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2DA8
                                                                • GlobalFree.KERNEL32(00000000), ref: 007F2DB3
                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2DC5
                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,0080FC38,00000000), ref: 007F2DDB
                                                                • GlobalFree.KERNEL32(00000000), ref: 007F2DEB
                                                                • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 007F2E11
                                                                • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 007F2E30
                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F2E52
                                                                • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007F303F
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                • String ID: $AutoIt v3$DISPLAY$static
                                                                • API String ID: 2211948467-2373415609
                                                                • Opcode ID: c39ad04bca326d5105c9ba4d78efadcb4ca7fde5d8e88ebc5da9d321ee0b4f55
                                                                • Instruction ID: 35a2e150b449eacb6cc4e1921681956e93e9c60fd27873c79a97a7bdccca3a53
                                                                • Opcode Fuzzy Hash: c39ad04bca326d5105c9ba4d78efadcb4ca7fde5d8e88ebc5da9d321ee0b4f55
                                                                • Instruction Fuzzy Hash: 52026C75500208EFDB14DFA4CC89EAE7BB9FF49714F108658F915AB2A1DB78AD01CB60
                                                                Function 008070D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetTextColor.GDI32(?,00000000), ref: 0080712F
                                                                • GetSysColorBrush.USER32(0000000F), ref: 00807160
                                                                • GetSysColor.USER32(0000000F), ref: 0080716C
                                                                • SetBkColor.GDI32(?,000000FF), ref: 00807186
                                                                • SelectObject.GDI32(?,?), ref: 00807195
                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 008071C0
                                                                • GetSysColor.USER32(00000010), ref: 008071C8
                                                                • CreateSolidBrush.GDI32(00000000), ref: 008071CF
                                                                • FrameRect.USER32(?,?,00000000), ref: 008071DE
                                                                • DeleteObject.GDI32(00000000), ref: 008071E5
                                                                • InflateRect.USER32(?,000000FE,000000FE), ref: 00807230
                                                                • FillRect.USER32(?,?,?), ref: 00807262
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00807284
                                                                  • Part of subcall function 008073E8: GetSysColor.USER32(00000012), ref: 00807421
                                                                  • Part of subcall function 008073E8: SetTextColor.GDI32(?,?), ref: 00807425
                                                                  • Part of subcall function 008073E8: GetSysColorBrush.USER32(0000000F), ref: 0080743B
                                                                  • Part of subcall function 008073E8: GetSysColor.USER32(0000000F), ref: 00807446
                                                                  • Part of subcall function 008073E8: GetSysColor.USER32(00000011), ref: 00807463
                                                                  • Part of subcall function 008073E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00807471
                                                                  • Part of subcall function 008073E8: SelectObject.GDI32(?,00000000), ref: 00807482
                                                                  • Part of subcall function 008073E8: SetBkColor.GDI32(?,00000000), ref: 0080748B
                                                                  • Part of subcall function 008073E8: SelectObject.GDI32(?,?), ref: 00807498
                                                                  • Part of subcall function 008073E8: InflateRect.USER32(?,000000FF,000000FF), ref: 008074B7
                                                                  • Part of subcall function 008073E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008074CE
                                                                  • Part of subcall function 008073E8: GetWindowLongW.USER32(00000000,000000F0), ref: 008074DB
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                                • String ID:
                                                                • API String ID: 4124339563-0
                                                                • Opcode ID: 9daef0da2075dd30b64f429f4670dd700e0c9b521dce9e4f386dcfd8f24d5f11
                                                                • Instruction ID: 5b588643880dbd92201986937914fbb35878da46059bfd83af5b6c87c0735079
                                                                • Opcode Fuzzy Hash: 9daef0da2075dd30b64f429f4670dd700e0c9b521dce9e4f386dcfd8f24d5f11
                                                                • Instruction Fuzzy Hash: 53A19F72408301AFDB919F64DC48E6BBBA9FF89320F100B19F962D61E1D771E944CB91
                                                                Function 00788D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DestroyWindow.USER32(?,?), ref: 00788E14
                                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 007C6AC5
                                                                • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 007C6AFE
                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 007C6F43
                                                                  • Part of subcall function 00788F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00788BE8,?,00000000,?,?,?,?,00788BBA,00000000,?), ref: 00788FC5
                                                                • SendMessageW.USER32(?,00001053), ref: 007C6F7F
                                                                • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 007C6F96
                                                                • ImageList_Destroy.COMCTL32(00000000,?), ref: 007C6FAC
                                                                • ImageList_Destroy.COMCTL32(00000000,?), ref: 007C6FB7
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                                • String ID: 0
                                                                • API String ID: 2760611726-4108050209
                                                                • Opcode ID: 66cf42454b1fae0c2c24195d5e07ad61c2c49e19190b33ed7a18875f5d9441c1
                                                                • Instruction ID: 97424c2011703f250fe9d0bf908cb886a9c7ac78c14adc40cb6908c11cb57a9a
                                                                • Opcode Fuzzy Hash: 66cf42454b1fae0c2c24195d5e07ad61c2c49e19190b33ed7a18875f5d9441c1
                                                                • Instruction Fuzzy Hash: E012AD34204201EFDB65DF24C888FA5BBE5FB49300F54456DF5958B261CB39EC92DB92
                                                                Function 007F2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DestroyWindow.USER32(00000000), ref: 007F273E
                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 007F286A
                                                                • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 007F28A9
                                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 007F28B9
                                                                • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 007F2900
                                                                • GetClientRect.USER32(00000000,?), ref: 007F290C
                                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 007F2955
                                                                • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 007F2964
                                                                • GetStockObject.GDI32(00000011), ref: 007F2974
                                                                • SelectObject.GDI32(00000000,00000000), ref: 007F2978
                                                                • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 007F2988
                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 007F2991
                                                                • DeleteDC.GDI32(00000000), ref: 007F299A
                                                                • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007F29C6
                                                                • SendMessageW.USER32(00000030,00000000,00000001), ref: 007F29DD
                                                                • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 007F2A1D
                                                                • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 007F2A31
                                                                • SendMessageW.USER32(00000404,00000001,00000000), ref: 007F2A42
                                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 007F2A77
                                                                • GetStockObject.GDI32(00000011), ref: 007F2A82
                                                                • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 007F2A8D
                                                                • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 007F2A97
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                • API String ID: 2910397461-517079104
                                                                • Opcode ID: 280e1a9f143677348e543e0f297af71bee70b016b7f9e9201064718ae5b10946
                                                                • Instruction ID: 66fdf088174a9eb64b21e2adaee694abf0867a85c05eaa3550820dfb61edc920
                                                                • Opcode Fuzzy Hash: 280e1a9f143677348e543e0f297af71bee70b016b7f9e9201064718ae5b10946
                                                                • Instruction Fuzzy Hash: C6B15D75A40209AFEB14DF68CC49FAE7BA9FB08714F108214FA14E7291D778ED41CBA0
                                                                Function 007E4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetErrorMode.KERNEL32(00000001), ref: 007E4AED
                                                                • GetDriveTypeW.KERNEL32(?,0080CB68,?,\\.\,0080CC08), ref: 007E4BCA
                                                                • SetErrorMode.KERNEL32(00000000,0080CB68,?,\\.\,0080CC08), ref: 007E4D36
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$DriveType
                                                                • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                • API String ID: 2907320926-4222207086
                                                                • Opcode ID: 5ff293b4774a9ec60ecd7dbe1af2789cb8ee6ee8983fd6e346330a23cc0b9473
                                                                • Instruction ID: 12d63bda0b6af932f943cb2967600e631384710c7bd24221456a2c5c50de8647
                                                                • Opcode Fuzzy Hash: 5ff293b4774a9ec60ecd7dbe1af2789cb8ee6ee8983fd6e346330a23cc0b9473
                                                                • Instruction Fuzzy Hash: 48619030606145EBCB14DF29C99596877F0FB48344B348415E80AEB7A1EB2EED61DBA1
                                                                Function 008073E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetSysColor.USER32(00000012), ref: 00807421
                                                                • SetTextColor.GDI32(?,?), ref: 00807425
                                                                • GetSysColorBrush.USER32(0000000F), ref: 0080743B
                                                                • GetSysColor.USER32(0000000F), ref: 00807446
                                                                • CreateSolidBrush.GDI32(?), ref: 0080744B
                                                                • GetSysColor.USER32(00000011), ref: 00807463
                                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00807471
                                                                • SelectObject.GDI32(?,00000000), ref: 00807482
                                                                • SetBkColor.GDI32(?,00000000), ref: 0080748B
                                                                • SelectObject.GDI32(?,?), ref: 00807498
                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 008074B7
                                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008074CE
                                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 008074DB
                                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0080752A
                                                                • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00807554
                                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00807572
                                                                • DrawFocusRect.USER32(?,?), ref: 0080757D
                                                                • GetSysColor.USER32(00000011), ref: 0080758E
                                                                • SetTextColor.GDI32(?,00000000), ref: 00807596
                                                                • DrawTextW.USER32(?,008070F5,000000FF,?,00000000), ref: 008075A8
                                                                • SelectObject.GDI32(?,?), ref: 008075BF
                                                                • DeleteObject.GDI32(?), ref: 008075CA
                                                                • SelectObject.GDI32(?,?), ref: 008075D0
                                                                • DeleteObject.GDI32(?), ref: 008075D5
                                                                • SetTextColor.GDI32(?,?), ref: 008075DB
                                                                • SetBkColor.GDI32(?,?), ref: 008075E5
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                • String ID:
                                                                • API String ID: 1996641542-0
                                                                • Opcode ID: 6b96d4991f829c00bed1347e83542ce7c9ab3b8c5185dd5dcd0e2c60043082ed
                                                                • Instruction ID: 57e34eb87f5cadc776367206afbc66a490d994367961e4114a4a1192f1ef62a9
                                                                • Opcode Fuzzy Hash: 6b96d4991f829c00bed1347e83542ce7c9ab3b8c5185dd5dcd0e2c60043082ed
                                                                • Instruction Fuzzy Hash: C2616A76D00218AFDF419FA4DC49AEEBFB9FB09320F104215F911AB2E1D775A940CB90
                                                                Function 00800FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCursorPos.USER32(?), ref: 00801128
                                                                • GetDesktopWindow.USER32 ref: 0080113D
                                                                • GetWindowRect.USER32(00000000), ref: 00801144
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00801199
                                                                • DestroyWindow.USER32(?), ref: 008011B9
                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 008011ED
                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0080120B
                                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0080121D
                                                                • SendMessageW.USER32(00000000,00000421,?,?), ref: 00801232
                                                                • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00801245
                                                                • IsWindowVisible.USER32(00000000), ref: 008012A1
                                                                • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 008012BC
                                                                • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 008012D0
                                                                • GetWindowRect.USER32(00000000,?), ref: 008012E8
                                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 0080130E
                                                                • GetMonitorInfoW.USER32(00000000,?), ref: 00801328
                                                                • CopyRect.USER32(?,?), ref: 0080133F
                                                                • SendMessageW.USER32(00000000,00000412,00000000), ref: 008013AA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                • String ID: ($0$tooltips_class32
                                                                • API String ID: 698492251-4156429822
                                                                • Opcode ID: 84c5f7382b1683a4cad4fd94419c82cb738b9ff2360b3ef60ba2d82cbb0bd49b
                                                                • Instruction ID: 3e839ffb404641be33d3131fbd47f3945fb93d086afd31b731b8d07156e46486
                                                                • Opcode Fuzzy Hash: 84c5f7382b1683a4cad4fd94419c82cb738b9ff2360b3ef60ba2d82cbb0bd49b
                                                                • Instruction Fuzzy Hash: 63B15971604341AFDB94DF64C888B6ABBE4FF88754F00891CF999DB2A1C771E844CB92
                                                                Function 00800241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharUpperBuffW.USER32(?,?), ref: 008002E5
                                                                • _wcslen.LIBCMT ref: 0080031F
                                                                • _wcslen.LIBCMT ref: 00800389
                                                                • _wcslen.LIBCMT ref: 008003F1
                                                                • _wcslen.LIBCMT ref: 00800475
                                                                • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 008004C5
                                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00800504
                                                                  • Part of subcall function 0078F9F2: _wcslen.LIBCMT ref: 0078F9FD
                                                                  • Part of subcall function 007D223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007D2258
                                                                  • Part of subcall function 007D223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 007D228A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                • API String ID: 1103490817-719923060
                                                                • Opcode ID: 2bdf82db6896830732310e3c48e70b0258524aeea886159d5b41b59cee5f8f49
                                                                • Instruction ID: e0bd63e88ace391cab2d1b63c8dd2cee06e2401eec535139ae07fa804891541d
                                                                • Opcode Fuzzy Hash: 2bdf82db6896830732310e3c48e70b0258524aeea886159d5b41b59cee5f8f49
                                                                • Instruction Fuzzy Hash: 88E19E312087058BCB64DF24C851A2AB3E6FF98758F14895DF896DB3A1DB34ED46CB81
                                                                Function 00788891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00788968
                                                                • GetSystemMetrics.USER32(00000007), ref: 00788970
                                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0078899B
                                                                • GetSystemMetrics.USER32(00000008), ref: 007889A3
                                                                • GetSystemMetrics.USER32(00000004), ref: 007889C8
                                                                • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 007889E5
                                                                • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 007889F5
                                                                • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00788A28
                                                                • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00788A3C
                                                                • GetClientRect.USER32(00000000,000000FF), ref: 00788A5A
                                                                • GetStockObject.GDI32(00000011), ref: 00788A76
                                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 00788A81
                                                                  • Part of subcall function 0078912D: GetCursorPos.USER32(?), ref: 00789141
                                                                  • Part of subcall function 0078912D: ScreenToClient.USER32(00000000,?), ref: 0078915E
                                                                  • Part of subcall function 0078912D: GetAsyncKeyState.USER32(00000001), ref: 00789183
                                                                  • Part of subcall function 0078912D: GetAsyncKeyState.USER32(00000002), ref: 0078919D
                                                                • SetTimer.USER32(00000000,00000000,00000028,007890FC), ref: 00788AA8
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                • String ID: AutoIt v3 GUI
                                                                • API String ID: 1458621304-248962490
                                                                • Opcode ID: 36e30e181e56dfe98fa13edcd6db07132933d610a7c6145df4718db5b38f20ba
                                                                • Instruction ID: 3b10b8045955d7166ac45249b7cad169c65746cf4ab8eb3263a38b0a53a20adf
                                                                • Opcode Fuzzy Hash: 36e30e181e56dfe98fa13edcd6db07132933d610a7c6145df4718db5b38f20ba
                                                                • Instruction Fuzzy Hash: 19B14C75A40209DFDF54EFA8CC89BAE7BB5FB48314F104229FA15A7290DB78A841CB51
                                                                Function 007D0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 007D1114
                                                                  • Part of subcall function 007D10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D1120
                                                                  • Part of subcall function 007D10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D112F
                                                                  • Part of subcall function 007D10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D1136
                                                                  • Part of subcall function 007D10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 007D114D
                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 007D0DF5
                                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 007D0E29
                                                                • GetLengthSid.ADVAPI32(?), ref: 007D0E40
                                                                • GetAce.ADVAPI32(?,00000000,?), ref: 007D0E7A
                                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007D0E96
                                                                • GetLengthSid.ADVAPI32(?), ref: 007D0EAD
                                                                • GetProcessHeap.KERNEL32(00000008,00000008), ref: 007D0EB5
                                                                • HeapAlloc.KERNEL32(00000000), ref: 007D0EBC
                                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 007D0EDD
                                                                • CopySid.ADVAPI32(00000000), ref: 007D0EE4
                                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 007D0F13
                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007D0F35
                                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 007D0F47
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 007D0F6E
                                                                • HeapFree.KERNEL32(00000000), ref: 007D0F75
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 007D0F7E
                                                                • HeapFree.KERNEL32(00000000), ref: 007D0F85
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 007D0F8E
                                                                • HeapFree.KERNEL32(00000000), ref: 007D0F95
                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 007D0FA1
                                                                • HeapFree.KERNEL32(00000000), ref: 007D0FA8
                                                                  • Part of subcall function 007D1193: GetProcessHeap.KERNEL32(00000008,007D0BB1,?,00000000,?,007D0BB1,?), ref: 007D11A1
                                                                  • Part of subcall function 007D1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,007D0BB1,?), ref: 007D11A8
                                                                  • Part of subcall function 007D1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,007D0BB1,?), ref: 007D11B7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                • String ID:
                                                                • API String ID: 4175595110-0
                                                                • Opcode ID: 7068d5ce7a680f29f5d1bce46414f79334c44f7a9b12e8a5a72f51412f40348e
                                                                • Instruction ID: ea6f97fd91a3e65173850e4d37a45e2d15176cdaf7ba0c73c06b97f63251abe0
                                                                • Opcode Fuzzy Hash: 7068d5ce7a680f29f5d1bce46414f79334c44f7a9b12e8a5a72f51412f40348e
                                                                • Instruction Fuzzy Hash: FD715C7290020AEFDF209FA5DC48FEEBBB8BF04310F144216F959E6291D7759A05CBA0
                                                                Function 007FC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007FC4BD
                                                                • RegCreateKeyExW.ADVAPI32(?,?,00000000,0080CC08,00000000,?,00000000,?,?), ref: 007FC544
                                                                • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 007FC5A4
                                                                • _wcslen.LIBCMT ref: 007FC5F4
                                                                • _wcslen.LIBCMT ref: 007FC66F
                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 007FC6B2
                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 007FC7C1
                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 007FC84D
                                                                • RegCloseKey.ADVAPI32(?), ref: 007FC881
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 007FC88E
                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 007FC960
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                                • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                • API String ID: 9721498-966354055
                                                                • Opcode ID: 90e03562d203fa417bcb82218c9e0c86b3069761a8fc7a623bd89b6ddcf5b06b
                                                                • Instruction ID: 3a7e788c19517eb1a8289c5f9170a150c551bca6f1724d8e96dc6f597e4e7115
                                                                • Opcode Fuzzy Hash: 90e03562d203fa417bcb82218c9e0c86b3069761a8fc7a623bd89b6ddcf5b06b
                                                                • Instruction Fuzzy Hash: E8126735204205DFDB15DF24C985A2AB7E5FF88754F14889CF98A9B3A2DB39EC41CB81
                                                                Function 0080091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharUpperBuffW.USER32(?,?), ref: 008009C6
                                                                • _wcslen.LIBCMT ref: 00800A01
                                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00800A54
                                                                • _wcslen.LIBCMT ref: 00800A8A
                                                                • _wcslen.LIBCMT ref: 00800B06
                                                                • _wcslen.LIBCMT ref: 00800B81
                                                                  • Part of subcall function 0078F9F2: _wcslen.LIBCMT ref: 0078F9FD
                                                                  • Part of subcall function 007D2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007D2BFA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                • API String ID: 1103490817-4258414348
                                                                • Opcode ID: e2bf9d367c66704325e0002503f68f77a609ac8f6fe86c021bd13bdca1b4a108
                                                                • Instruction ID: a23d0117675603bb69b19a54bc65792c7bdddbd5987710b37f089e080e44a49f
                                                                • Opcode Fuzzy Hash: e2bf9d367c66704325e0002503f68f77a609ac8f6fe86c021bd13bdca1b4a108
                                                                • Instruction Fuzzy Hash: 76E156312087019FCB54DF24C850A2AB7E1FF99358F14895DE89A9B3A2DB34ED46CB91
                                                                Function 007FC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharUpper
                                                                • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                • API String ID: 1256254125-909552448
                                                                • Opcode ID: cf90f65d624dcc8f04d9d2176dc79da4c3ba65a93b8f3256e8932df5c123546b
                                                                • Instruction ID: bc3f31adf92fa87f1ef56f6b62b2eb8d9630760c887dde9f381cde98f29fd354
                                                                • Opcode Fuzzy Hash: cf90f65d624dcc8f04d9d2176dc79da4c3ba65a93b8f3256e8932df5c123546b
                                                                • Instruction Fuzzy Hash: EC71D57260052E8BCF22DE7CCE515BA3391AFA0764F254524FA66D7384E63DED45C3A0
                                                                Function 0080833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _wcslen.LIBCMT ref: 0080835A
                                                                • _wcslen.LIBCMT ref: 0080836E
                                                                • _wcslen.LIBCMT ref: 00808391
                                                                • _wcslen.LIBCMT ref: 008083B4
                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 008083F2
                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00805BF2), ref: 0080844E
                                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00808487
                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 008084CA
                                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00808501
                                                                • FreeLibrary.KERNEL32(?), ref: 0080850D
                                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0080851D
                                                                • DestroyIcon.USER32(?,?,?,?,?,00805BF2), ref: 0080852C
                                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00808549
                                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00808555
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                                • String ID: .dll$.exe$.icl
                                                                • API String ID: 799131459-1154884017
                                                                • Opcode ID: 94c98fa531935311e776455c8d626348c95e68aa574f25919906cc86d51d2e26
                                                                • Instruction ID: 1a01a232b516ac254929101abcd60dc5e8e113d23f317a133f3486ad770b01c6
                                                                • Opcode Fuzzy Hash: 94c98fa531935311e776455c8d626348c95e68aa574f25919906cc86d51d2e26
                                                                • Instruction Fuzzy Hash: 9561F071500619FEEB64CF64DC85FBE77A8FB08B21F104609F855E61D1DB78A980CBA0
                                                                Function 00777778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                • API String ID: 0-1645009161
                                                                • Opcode ID: 6f059b7b8d331eb145726f8a644300860007fd40464b261972f3f64451303c59
                                                                • Instruction ID: d826c952a40948d24d38808b124c27bb937b2f2f58018de56f22452bdecf56b6
                                                                • Opcode Fuzzy Hash: 6f059b7b8d331eb145726f8a644300860007fd40464b261972f3f64451303c59
                                                                • Instruction Fuzzy Hash: 2481E471644209FBDF29AF64DC46FAE37A8BF15340F008024F918AA292EB7CD911C7E1
                                                                Function 007E3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharLowerBuffW.USER32(?,?), ref: 007E3EF8
                                                                • _wcslen.LIBCMT ref: 007E3F03
                                                                • _wcslen.LIBCMT ref: 007E3F5A
                                                                • _wcslen.LIBCMT ref: 007E3F98
                                                                • GetDriveTypeW.KERNEL32(?), ref: 007E3FD6
                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007E401E
                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007E4059
                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007E4087
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                                • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                • API String ID: 1839972693-4113822522
                                                                • Opcode ID: f4d95bf821a9c257e0705ff0972520dc6fcbfc8e39a57ed7c1a2d8c4fef8b9e2
                                                                • Instruction ID: 237aba4bdee1c45a734d0d8e735214e3ae92942b2b8dae3b53ddcb76d9d0a0ff
                                                                • Opcode Fuzzy Hash: f4d95bf821a9c257e0705ff0972520dc6fcbfc8e39a57ed7c1a2d8c4fef8b9e2
                                                                • Instruction Fuzzy Hash: EF71E3326042019FCB10EF29C88586AB7F4FF987A4F10892DF59997251EB38DE46CB91
                                                                Function 007D5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadIconW.USER32(00000063), ref: 007D5A2E
                                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 007D5A40
                                                                • SetWindowTextW.USER32(?,?), ref: 007D5A57
                                                                • GetDlgItem.USER32(?,000003EA), ref: 007D5A6C
                                                                • SetWindowTextW.USER32(00000000,?), ref: 007D5A72
                                                                • GetDlgItem.USER32(?,000003E9), ref: 007D5A82
                                                                • SetWindowTextW.USER32(00000000,?), ref: 007D5A88
                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 007D5AA9
                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 007D5AC3
                                                                • GetWindowRect.USER32(?,?), ref: 007D5ACC
                                                                • _wcslen.LIBCMT ref: 007D5B33
                                                                • SetWindowTextW.USER32(?,?), ref: 007D5B6F
                                                                • GetDesktopWindow.USER32 ref: 007D5B75
                                                                • GetWindowRect.USER32(00000000), ref: 007D5B7C
                                                                • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 007D5BD3
                                                                • GetClientRect.USER32(?,?), ref: 007D5BE0
                                                                • PostMessageW.USER32(?,00000005,00000000,?), ref: 007D5C05
                                                                • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 007D5C2F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                                • String ID:
                                                                • API String ID: 895679908-0
                                                                • Opcode ID: c7c8c065dbc99b128ef91fbc2b9679ea2483314c2c84ed6c3e7846a90f53fc40
                                                                • Instruction ID: 1d1713aa2991e3c29302ff7c85f70c03709fef76ccf2cb521a168419a7041bdf
                                                                • Opcode Fuzzy Hash: c7c8c065dbc99b128ef91fbc2b9679ea2483314c2c84ed6c3e7846a90f53fc40
                                                                • Instruction Fuzzy Hash: D0716F71900B05EFDB20DFA8CE85A6EBBF5FF48704F10461AE552A26A0D779E944CB50
                                                                Function 007EFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadCursorW.USER32(00000000,00007F89), ref: 007EFE27
                                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 007EFE32
                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 007EFE3D
                                                                • LoadCursorW.USER32(00000000,00007F03), ref: 007EFE48
                                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 007EFE53
                                                                • LoadCursorW.USER32(00000000,00007F01), ref: 007EFE5E
                                                                • LoadCursorW.USER32(00000000,00007F81), ref: 007EFE69
                                                                • LoadCursorW.USER32(00000000,00007F88), ref: 007EFE74
                                                                • LoadCursorW.USER32(00000000,00007F80), ref: 007EFE7F
                                                                • LoadCursorW.USER32(00000000,00007F86), ref: 007EFE8A
                                                                • LoadCursorW.USER32(00000000,00007F83), ref: 007EFE95
                                                                • LoadCursorW.USER32(00000000,00007F85), ref: 007EFEA0
                                                                • LoadCursorW.USER32(00000000,00007F82), ref: 007EFEAB
                                                                • LoadCursorW.USER32(00000000,00007F84), ref: 007EFEB6
                                                                • LoadCursorW.USER32(00000000,00007F04), ref: 007EFEC1
                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 007EFECC
                                                                • GetCursorInfo.USER32(?), ref: 007EFEDC
                                                                • GetLastError.KERNEL32 ref: 007EFF1E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Cursor$Load$ErrorInfoLast
                                                                • String ID:
                                                                • API String ID: 3215588206-0
                                                                • Opcode ID: d609facd195119bba317d9e3e507b93e2bc1c455761e4b6293affe9219430db8
                                                                • Instruction ID: 2b86fe2c53827a32d778f15a4a12eb6644c9cf336f14914cb82588a69dd0368a
                                                                • Opcode Fuzzy Hash: d609facd195119bba317d9e3e507b93e2bc1c455761e4b6293affe9219430db8
                                                                • Instruction Fuzzy Hash: E14154B0D05359AADB109FBA8C89C5EBFE8FF08354B50852AF11DE7681DB789901CE91
                                                                Function 007900C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 007900C6
                                                                  • Part of subcall function 007900ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0084070C,00000FA0,47721205,?,?,?,?,007B23B3,000000FF), ref: 0079011C
                                                                  • Part of subcall function 007900ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,007B23B3,000000FF), ref: 00790127
                                                                  • Part of subcall function 007900ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,007B23B3,000000FF), ref: 00790138
                                                                  • Part of subcall function 007900ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0079014E
                                                                  • Part of subcall function 007900ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0079015C
                                                                  • Part of subcall function 007900ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0079016A
                                                                  • Part of subcall function 007900ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00790195
                                                                  • Part of subcall function 007900ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 007901A0
                                                                • ___scrt_fastfail.LIBCMT ref: 007900E7
                                                                  • Part of subcall function 007900A3: __onexit.LIBCMT ref: 007900A9
                                                                Strings
                                                                • InitializeConditionVariable, xrefs: 00790148
                                                                • WakeAllConditionVariable, xrefs: 00790162
                                                                • kernel32.dll, xrefs: 00790133
                                                                • SleepConditionVariableCS, xrefs: 00790154
                                                                • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00790122
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                                • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                • API String ID: 66158676-1714406822
                                                                • Opcode ID: a7f266b29d7c00da593ff616bdeaa2aac62e805ae9875c2a28cb25b2e72d2112
                                                                • Instruction ID: d0285a3fe0daee7ce4ca46afb4bc6c188f7931314454ce82a253c043b04c9fa8
                                                                • Opcode Fuzzy Hash: a7f266b29d7c00da593ff616bdeaa2aac62e805ae9875c2a28cb25b2e72d2112
                                                                • Instruction Fuzzy Hash: 7921D732695714AFEB606FA4BC09B6E37D8FB05B51F00422AF901E37D2DB7C98008AD1
                                                                Function 007D30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen
                                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                • API String ID: 176396367-1603158881
                                                                • Opcode ID: f270be257d42022a9c9011a589b04f05c82e6cf98a21025433b37e2c2cd09a31
                                                                • Instruction ID: f7a407bfde89a4bb3273f57577267a572819ba8674e8e71df416705c5ba2de7a
                                                                • Opcode Fuzzy Hash: f270be257d42022a9c9011a589b04f05c82e6cf98a21025433b37e2c2cd09a31
                                                                • Instruction Fuzzy Hash: FAE1D232A00516EACF149FB8C855AEDFBB0BF54750F14821AE556F7340DB38AE4587A1
                                                                Function 007E44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharLowerBuffW.USER32(00000000,00000000,0080CC08), ref: 007E4527
                                                                • _wcslen.LIBCMT ref: 007E453B
                                                                • _wcslen.LIBCMT ref: 007E4599
                                                                • _wcslen.LIBCMT ref: 007E45F4
                                                                • _wcslen.LIBCMT ref: 007E463F
                                                                • _wcslen.LIBCMT ref: 007E46A7
                                                                  • Part of subcall function 0078F9F2: _wcslen.LIBCMT ref: 0078F9FD
                                                                • GetDriveTypeW.KERNEL32(?,00836BF0,00000061), ref: 007E4743
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharDriveLowerType
                                                                • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                • API String ID: 2055661098-1000479233
                                                                • Opcode ID: 9bd89e677aa26ee8bfa3f908eb9da445b79f507721883a2ab04f462f8f52f68e
                                                                • Instruction ID: ff902caf70590d694fa0d43c680045aff4057827a11a881c62c9203462ddc284
                                                                • Opcode Fuzzy Hash: 9bd89e677aa26ee8bfa3f908eb9da445b79f507721883a2ab04f462f8f52f68e
                                                                • Instruction Fuzzy Hash: E6B125316093429FC710DF29C894A6EB7E5FFA9760F10891DF19AC7291E738D844CBA2
                                                                Function 007FAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _wcslen.LIBCMT ref: 007FB198
                                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007FB1B0
                                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007FB1D4
                                                                • _wcslen.LIBCMT ref: 007FB200
                                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007FB214
                                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007FB236
                                                                • _wcslen.LIBCMT ref: 007FB332
                                                                  • Part of subcall function 007E05A7: GetStdHandle.KERNEL32(000000F6), ref: 007E05C6
                                                                • _wcslen.LIBCMT ref: 007FB34B
                                                                • _wcslen.LIBCMT ref: 007FB366
                                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007FB3B6
                                                                • GetLastError.KERNEL32(00000000), ref: 007FB407
                                                                • CloseHandle.KERNEL32(?), ref: 007FB439
                                                                • CloseHandle.KERNEL32(00000000), ref: 007FB44A
                                                                • CloseHandle.KERNEL32(00000000), ref: 007FB45C
                                                                • CloseHandle.KERNEL32(00000000), ref: 007FB46E
                                                                • CloseHandle.KERNEL32(?), ref: 007FB4E3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                                • String ID:
                                                                • API String ID: 2178637699-0
                                                                • Opcode ID: b42bbfef49faaac6daed3dc3647c0555ec02cc4ca0938bed9145a3bc168e5691
                                                                • Instruction ID: 0475648af70aa50abac8014177626b73a76a5d3c8c79cd85286cd4420aecbf7e
                                                                • Opcode Fuzzy Hash: b42bbfef49faaac6daed3dc3647c0555ec02cc4ca0938bed9145a3bc168e5691
                                                                • Instruction Fuzzy Hash: D1F18A31608244DFCB14EF24C885B2EBBE1AF85354F14895DF9998B3A2CB39EC44CB52
                                                                Function 007F3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,0080CC08), ref: 007F40BB
                                                                • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 007F40CD
                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0080CC08), ref: 007F40F2
                                                                • FreeLibrary.KERNEL32(00000000,?,0080CC08), ref: 007F413E
                                                                • StringFromGUID2.OLE32(?,?,00000028,?,0080CC08), ref: 007F41A8
                                                                • SysFreeString.OLEAUT32(00000009), ref: 007F4262
                                                                • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 007F42C8
                                                                • SysFreeString.OLEAUT32(?), ref: 007F42F2
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                                • String ID: GetModuleHandleExW$kernel32.dll
                                                                • API String ID: 354098117-199464113
                                                                • Opcode ID: c204594e4fd51f1e1867fcd9f65179bc1c46476124abd29513634e2e73aa7bc8
                                                                • Instruction ID: fd36aa0395061aa0bd3804ff0a58bab91a2800303d595ebb71705baec56bd4a1
                                                                • Opcode Fuzzy Hash: c204594e4fd51f1e1867fcd9f65179bc1c46476124abd29513634e2e73aa7bc8
                                                                • Instruction Fuzzy Hash: B8120975A00119EFDB14DF94C888EBEB7B5FF45318F248098EA05AB251DB35ED46CBA0
                                                                Function 0077326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemCount.USER32(00841990), ref: 007B2F8D
                                                                • GetMenuItemCount.USER32(00841990), ref: 007B303D
                                                                • GetCursorPos.USER32(?), ref: 007B3081
                                                                • SetForegroundWindow.USER32(00000000), ref: 007B308A
                                                                • TrackPopupMenuEx.USER32(00841990,00000000,?,00000000,00000000,00000000), ref: 007B309D
                                                                • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 007B30A9
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                                • String ID: 0
                                                                • API String ID: 36266755-4108050209
                                                                • Opcode ID: 14b08c1cf7b2da2d4767123d8d2d9d77b126641e19f2dcb5ead91f30a6f36d7a
                                                                • Instruction ID: 97fbe6a6df4f3454d6b647ae71e84ca0ddf21424e6b90f4e3704d46bfe7d6578
                                                                • Opcode Fuzzy Hash: 14b08c1cf7b2da2d4767123d8d2d9d77b126641e19f2dcb5ead91f30a6f36d7a
                                                                • Instruction Fuzzy Hash: 94714B70641205BFEB219F24CC89FEABF65FF05364F204206F5286A1E2C7B9AD50DB50
                                                                Function 00806CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DestroyWindow.USER32(00000000,?), ref: 00806DEB
                                                                  • Part of subcall function 00776B57: _wcslen.LIBCMT ref: 00776B6A
                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00806E5F
                                                                • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00806E81
                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00806E94
                                                                • DestroyWindow.USER32(?), ref: 00806EB5
                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00770000,00000000), ref: 00806EE4
                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00806EFD
                                                                • GetDesktopWindow.USER32 ref: 00806F16
                                                                • GetWindowRect.USER32(00000000), ref: 00806F1D
                                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00806F35
                                                                • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00806F4D
                                                                  • Part of subcall function 00789944: GetWindowLongW.USER32(?,000000EB), ref: 00789952
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                                • String ID: 0$tooltips_class32
                                                                • API String ID: 2429346358-3619404913
                                                                • Opcode ID: ce97bec37870c9751959afe4ddad5326085c58fbb89594ab62eaf769b235109e
                                                                • Instruction ID: dc40ead2e1f292c2c4bf624e6e26b4ccbf1c45d0daab204b0ccb0db3205cb0f4
                                                                • Opcode Fuzzy Hash: ce97bec37870c9751959afe4ddad5326085c58fbb89594ab62eaf769b235109e
                                                                • Instruction Fuzzy Hash: 6E719A74100341AFDBA1CF18DC48EAABBE9FB89304F54051DF999C72A1DB31E966CB11
                                                                Function 0080911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                • DragQueryPoint.SHELL32(?,?), ref: 00809147
                                                                  • Part of subcall function 00807674: ClientToScreen.USER32(?,?), ref: 0080769A
                                                                  • Part of subcall function 00807674: GetWindowRect.USER32(?,?), ref: 00807710
                                                                  • Part of subcall function 00807674: PtInRect.USER32(?,?,00808B89), ref: 00807720
                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 008091B0
                                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 008091BB
                                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 008091DE
                                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00809225
                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 0080923E
                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00809255
                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00809277
                                                                • DragFinish.SHELL32(?), ref: 0080927E
                                                                • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00809371
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                • API String ID: 221274066-3440237614
                                                                • Opcode ID: cc71ba3a3f485e5ef0dee28ba614f25a6cfaf74cd9d021134900ad473dd0d836
                                                                • Instruction ID: 9730cf2891603fbe019b7b00d842c342cee2b55175323c66b52e81e09deabe52
                                                                • Opcode Fuzzy Hash: cc71ba3a3f485e5ef0dee28ba614f25a6cfaf74cd9d021134900ad473dd0d836
                                                                • Instruction Fuzzy Hash: 63616C71108301AFDB41DF64DC89DAFBBE8FF99350F004A1DF6A5922A1DB309A49CB52
                                                                Function 007EC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007EC4B0
                                                                • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 007EC4C3
                                                                • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 007EC4D7
                                                                • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 007EC4F0
                                                                • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 007EC533
                                                                • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 007EC549
                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007EC554
                                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 007EC584
                                                                • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 007EC5DC
                                                                • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 007EC5F0
                                                                • InternetCloseHandle.WININET(00000000), ref: 007EC5FB
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                                • String ID:
                                                                • API String ID: 3800310941-3916222277
                                                                • Opcode ID: 1ca59a0f1065525fd9d3d86f85d2a93ef696539dee004e00e06499a2e79e2ef9
                                                                • Instruction ID: 422cc7f16f29991847b5705e0daea81e97baf6295134a97c8bdc7b1b1671ff5d
                                                                • Opcode Fuzzy Hash: 1ca59a0f1065525fd9d3d86f85d2a93ef696539dee004e00e06499a2e79e2ef9
                                                                • Instruction Fuzzy Hash: 6B518DB4501388BFEB229F66C988AAB7BFCFF08344F10451AF945D6250DB38E915DB60
                                                                Function 0080856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00808592
                                                                • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008085A2
                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008085AD
                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008085BA
                                                                • GlobalLock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008085C8
                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008085D7
                                                                • GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008085E0
                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008085E7
                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008085F8
                                                                • OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0080FC38,?), ref: 00808611
                                                                • GlobalFree.KERNEL32(00000000), ref: 00808621
                                                                • GetObjectW.GDI32(?,00000018,?), ref: 00808641
                                                                • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00808671
                                                                • DeleteObject.GDI32(?), ref: 00808699
                                                                • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 008086AF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                • String ID:
                                                                • API String ID: 3840717409-0
                                                                • Opcode ID: e7f2402374a674bede1e06dcde5665163932a67ddd37387443d9dd521585c62a
                                                                • Instruction ID: f009ef9cf9aa0ee5bb30e3d4017dea3ff1e4f5c908bb6d2baafbd2afac576fa9
                                                                • Opcode Fuzzy Hash: e7f2402374a674bede1e06dcde5665163932a67ddd37387443d9dd521585c62a
                                                                • Instruction Fuzzy Hash: 37414A71600208EFDB519FA5CC88EAE7BB8FF99711F108158F91AE72A0DB319D41CB20
                                                                Function 007E14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(00000000), ref: 007E1502
                                                                • VariantCopy.OLEAUT32(?,?), ref: 007E150B
                                                                • VariantClear.OLEAUT32(?), ref: 007E1517
                                                                • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 007E15FB
                                                                • VarR8FromDec.OLEAUT32(?,?), ref: 007E1657
                                                                • VariantInit.OLEAUT32(?), ref: 007E1708
                                                                • SysFreeString.OLEAUT32(?), ref: 007E178C
                                                                • VariantClear.OLEAUT32(?), ref: 007E17D8
                                                                • VariantClear.OLEAUT32(?), ref: 007E17E7
                                                                • VariantInit.OLEAUT32(00000000), ref: 007E1823
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                                                • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                • API String ID: 1234038744-3931177956
                                                                • Opcode ID: f3b5e8689a0455a66633e18297e473a40b1f79be5ac212ab88b3fcf42dec4262
                                                                • Instruction ID: 190b000ca568982199915e3269def8b253c66a1c272a54495595173c31b8294f
                                                                • Opcode Fuzzy Hash: f3b5e8689a0455a66633e18297e473a40b1f79be5ac212ab88b3fcf42dec4262
                                                                • Instruction Fuzzy Hash: 28D11571A01145EBDB00AF66D88ABBDB7B5BF49700F50815AF806AB184DB3CEC60DB61
                                                                Function 007FB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007FC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007FB6AE,?,?), ref: 007FC9B5
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FC9F1
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FCA68
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FCA9E
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007FB6F4
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007FB772
                                                                • RegDeleteValueW.ADVAPI32(?,?), ref: 007FB80A
                                                                • RegCloseKey.ADVAPI32(?), ref: 007FB87E
                                                                • RegCloseKey.ADVAPI32(?), ref: 007FB89C
                                                                • LoadLibraryA.KERNEL32(advapi32.dll), ref: 007FB8F2
                                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 007FB904
                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 007FB922
                                                                • FreeLibrary.KERNEL32(00000000), ref: 007FB983
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 007FB994
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                                • API String ID: 146587525-4033151799
                                                                • Opcode ID: afe187ce53e08517a110c74de2e78c223d29cf1a0a41ba46cd882bb7d91087ca
                                                                • Instruction ID: cd081a539cdc0e133c9cc34f08412d920dc20d4e9ec5ec5be7651c3c40be45a3
                                                                • Opcode Fuzzy Hash: afe187ce53e08517a110c74de2e78c223d29cf1a0a41ba46cd882bb7d91087ca
                                                                • Instruction Fuzzy Hash: D0C17B31208205EFD714DF24C499F2ABBE5BF84358F14855CE69A8B3A2CB79EC45CB91
                                                                Function 007F255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDC.USER32(00000000), ref: 007F25D8
                                                                • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 007F25E8
                                                                • CreateCompatibleDC.GDI32(?), ref: 007F25F4
                                                                • SelectObject.GDI32(00000000,?), ref: 007F2601
                                                                • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 007F266D
                                                                • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 007F26AC
                                                                • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 007F26D0
                                                                • SelectObject.GDI32(?,?), ref: 007F26D8
                                                                • DeleteObject.GDI32(?), ref: 007F26E1
                                                                • DeleteDC.GDI32(?), ref: 007F26E8
                                                                • ReleaseDC.USER32(00000000,?), ref: 007F26F3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                • String ID: (
                                                                • API String ID: 2598888154-3887548279
                                                                • Opcode ID: e996054acb0d5afa6f01f407d38fa57cf68975d4b2b024121d532fb707af70cd
                                                                • Instruction ID: 376c2423c439bd0ce67cbf503bf8a00bb943eae204886a092194909124b8bbff
                                                                • Opcode Fuzzy Hash: e996054acb0d5afa6f01f407d38fa57cf68975d4b2b024121d532fb707af70cd
                                                                • Instruction Fuzzy Hash: 6261D275D00219EFCF14CFA4D884AAEBBB5FF48310F208529EA55A7351E774A951CF60
                                                                Function 007ADA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • ___free_lconv_mon.LIBCMT ref: 007ADAA1
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD659
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD66B
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD67D
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD68F
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD6A1
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD6B3
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD6C5
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD6D7
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD6E9
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD6FB
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD70D
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD71F
                                                                  • Part of subcall function 007AD63C: _free.LIBCMT ref: 007AD731
                                                                • _free.LIBCMT ref: 007ADA96
                                                                  • Part of subcall function 007A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000), ref: 007A29DE
                                                                  • Part of subcall function 007A29C8: GetLastError.KERNEL32(00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000,00000000), ref: 007A29F0
                                                                • _free.LIBCMT ref: 007ADAB8
                                                                • _free.LIBCMT ref: 007ADACD
                                                                • _free.LIBCMT ref: 007ADAD8
                                                                • _free.LIBCMT ref: 007ADAFA
                                                                • _free.LIBCMT ref: 007ADB0D
                                                                • _free.LIBCMT ref: 007ADB1B
                                                                • _free.LIBCMT ref: 007ADB26
                                                                • _free.LIBCMT ref: 007ADB5E
                                                                • _free.LIBCMT ref: 007ADB65
                                                                • _free.LIBCMT ref: 007ADB82
                                                                • _free.LIBCMT ref: 007ADB9A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                • String ID:
                                                                • API String ID: 161543041-0
                                                                • Opcode ID: 93eff5da3b64ef0b8986d2c5b88b9ea045bd7f7dc51739eb9e51b10bdbbdf609
                                                                • Instruction ID: ac293dbc983880a2aa39b06f2c50e558c2f13938ea6b165d68366d8d40f25bd4
                                                                • Opcode Fuzzy Hash: 93eff5da3b64ef0b8986d2c5b88b9ea045bd7f7dc51739eb9e51b10bdbbdf609
                                                                • Instruction Fuzzy Hash: 77318D71604304DFEB31AA78E849B5B77E8FF82710F108619E04AE75A2DF38BC408B21
                                                                Function 007D365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetClassNameW.USER32(?,?,00000100), ref: 007D369C
                                                                • _wcslen.LIBCMT ref: 007D36A7
                                                                • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 007D3797
                                                                • GetClassNameW.USER32(?,?,00000400), ref: 007D380C
                                                                • GetDlgCtrlID.USER32(?), ref: 007D385D
                                                                • GetWindowRect.USER32(?,?), ref: 007D3882
                                                                • GetParent.USER32(?), ref: 007D38A0
                                                                • ScreenToClient.USER32(00000000), ref: 007D38A7
                                                                • GetClassNameW.USER32(?,?,00000100), ref: 007D3921
                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 007D395D
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                                                • String ID: %s%u
                                                                • API String ID: 4010501982-679674701
                                                                • Opcode ID: f1704dc72d6dfaa9f134fff0634f5f13ea3224cecdb4e694c1659d014890a52a
                                                                • Instruction ID: a9d77e4d542d9964fc6eb0f16447f50d570e799ec5952ad9850fb053fef87004
                                                                • Opcode Fuzzy Hash: f1704dc72d6dfaa9f134fff0634f5f13ea3224cecdb4e694c1659d014890a52a
                                                                • Instruction Fuzzy Hash: AC91B571204606EFD715DF24C895FAAF7B8FF44354F00462AF999D2290DB38EA45CBA2
                                                                Function 007D4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetClassNameW.USER32(?,?,00000400), ref: 007D4994
                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 007D49DA
                                                                • _wcslen.LIBCMT ref: 007D49EB
                                                                • CharUpperBuffW.USER32(?,00000000), ref: 007D49F7
                                                                • _wcsstr.LIBVCRUNTIME ref: 007D4A2C
                                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 007D4A64
                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 007D4A9D
                                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 007D4AE6
                                                                • GetClassNameW.USER32(?,?,00000400), ref: 007D4B20
                                                                • GetWindowRect.USER32(?,?), ref: 007D4B8B
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                                • String ID: ThumbnailClass
                                                                • API String ID: 1311036022-1241985126
                                                                • Opcode ID: 62ede99ef3a46b73bb397d704cf81ae4e7a12b689dfbbda98553c1e183e7b4b7
                                                                • Instruction ID: 269083cf78f837d8415c93d4d604ecd98c6352ebfe8ab8c371acd154bd3c61ee
                                                                • Opcode Fuzzy Hash: 62ede99ef3a46b73bb397d704cf81ae4e7a12b689dfbbda98553c1e183e7b4b7
                                                                • Instruction Fuzzy Hash: 4491CB710042059FDB04CF14C989FAA77E8FF94354F04856BFD899A296EB38ED45CBA1
                                                                Function 00808D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00808D5A
                                                                • GetFocus.USER32 ref: 00808D6A
                                                                • GetDlgCtrlID.USER32(00000000), ref: 00808D75
                                                                • DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00808E1D
                                                                • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00808ECF
                                                                • GetMenuItemCount.USER32(?), ref: 00808EEC
                                                                • GetMenuItemID.USER32(?,00000000), ref: 00808EFC
                                                                • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00808F2E
                                                                • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00808F70
                                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00808FA1
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
                                                                • String ID: 0
                                                                • API String ID: 1026556194-4108050209
                                                                • Opcode ID: 83370db5f38c58e9c2d2d44f38f71bae39f339c11ec329115eb2c36c22efecd2
                                                                • Instruction ID: fbbb3c9a72619dfc812cc0225f3952f37d7a1e1ff11fccbc1e2782d386aeba2f
                                                                • Opcode Fuzzy Hash: 83370db5f38c58e9c2d2d44f38f71bae39f339c11ec329115eb2c36c22efecd2
                                                                • Instruction Fuzzy Hash: B0818B71504305EBDBA0DF24DC84AABBBE9FB88354F140A19F994D72D1DB70D980CB62
                                                                Function 007DBF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(00841990,000000FF,00000000,00000030), ref: 007DBFAC
                                                                • SetMenuItemInfoW.USER32(00841990,00000004,00000000,00000030), ref: 007DBFE1
                                                                • Sleep.KERNEL32(000001F4), ref: 007DBFF3
                                                                • GetMenuItemCount.USER32(?), ref: 007DC039
                                                                • GetMenuItemID.USER32(?,00000000), ref: 007DC056
                                                                • GetMenuItemID.USER32(?,-00000001), ref: 007DC082
                                                                • GetMenuItemID.USER32(?,?), ref: 007DC0C9
                                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007DC10F
                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007DC124
                                                                • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007DC145
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                                • String ID: 0
                                                                • API String ID: 1460738036-4108050209
                                                                • Opcode ID: d6e1c6192ba0200bce235bc1cc7d261f9b751b27b8e38d41c40a4ed6f969d99f
                                                                • Instruction ID: f02b8e588d1266f5fa03c4522f93260658a2f4a91b7ad503893e8c1a58bb5eb0
                                                                • Opcode Fuzzy Hash: d6e1c6192ba0200bce235bc1cc7d261f9b751b27b8e38d41c40a4ed6f969d99f
                                                                • Instruction Fuzzy Hash: F06190B090025AEFDF22CF68DD88AEEBBB8FB05344F104156E911A3391D739AD45CB60
                                                                Function 007DDC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetFileVersionInfoSizeW.VERSION(?,?), ref: 007DDC20
                                                                • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 007DDC46
                                                                • _wcslen.LIBCMT ref: 007DDC50
                                                                • _wcsstr.LIBVCRUNTIME ref: 007DDCA0
                                                                • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 007DDCBC
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
                                                                • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                • API String ID: 1939486746-1459072770
                                                                • Opcode ID: e640a84d5e01598a0892dfecf3cddab894f32e9e01337862c497e4850948cda8
                                                                • Instruction ID: 8858c5b2fe91c512fa1d6b59a1e8fa2f351d146ad22ceaa7adbc5628ffa63363
                                                                • Opcode Fuzzy Hash: e640a84d5e01598a0892dfecf3cddab894f32e9e01337862c497e4850948cda8
                                                                • Instruction Fuzzy Hash: DB41F872640205BAEF20AB789C4BEBF777CEF55750F10416AF900E6292EA7C9D1187B4
                                                                Function 007FCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 007FCC64
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 007FCC8D
                                                                • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 007FCD48
                                                                  • Part of subcall function 007FCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 007FCCAA
                                                                  • Part of subcall function 007FCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 007FCCBD
                                                                  • Part of subcall function 007FCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 007FCCCF
                                                                  • Part of subcall function 007FCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 007FCD05
                                                                  • Part of subcall function 007FCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 007FCD28
                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 007FCCF3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                                • API String ID: 2734957052-4033151799
                                                                • Opcode ID: 9a7a0fe4c64274749280e0ce867a2ce8dc80e01ab48e8f8b4bc6721cc0fbb5ac
                                                                • Instruction ID: 4e909b6df606c4cb770612ba03bd49ba3ec972e4cf72d60d53847a1776bcb962
                                                                • Opcode Fuzzy Hash: 9a7a0fe4c64274749280e0ce867a2ce8dc80e01ab48e8f8b4bc6721cc0fbb5ac
                                                                • Instruction Fuzzy Hash: A2316F71A0112DBBDB618F54DD88EFFBB7CEF45750F000165BA06E6240DB389A45EAB0
                                                                Function 007E3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007E3D40
                                                                • _wcslen.LIBCMT ref: 007E3D6D
                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 007E3D9D
                                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 007E3DBE
                                                                • RemoveDirectoryW.KERNEL32(?), ref: 007E3DCE
                                                                • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 007E3E55
                                                                • CloseHandle.KERNEL32(00000000), ref: 007E3E60
                                                                • CloseHandle.KERNEL32(00000000), ref: 007E3E6B
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                                • String ID: :$\$\??\%s
                                                                • API String ID: 1149970189-3457252023
                                                                • Opcode ID: ebb59e1622235b37924ef4c277b9a63022213ae134ee846df76e92c65a210574
                                                                • Instruction ID: 3ab0f72292340fe3fe3d55a2d8b868110c8b59be300dcbd2bd8c0b2c0f22b742
                                                                • Opcode Fuzzy Hash: ebb59e1622235b37924ef4c277b9a63022213ae134ee846df76e92c65a210574
                                                                • Instruction Fuzzy Hash: 2631AF72A00249ABDB21DFA1DC49FEB37BCFF88700F5041A5F519D6160EB7897448B64
                                                                Function 007DE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • timeGetTime.WINMM ref: 007DE6B4
                                                                  • Part of subcall function 0078E551: timeGetTime.WINMM(?,?,007DE6D4), ref: 0078E555
                                                                • Sleep.KERNEL32(0000000A), ref: 007DE6E1
                                                                • EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 007DE705
                                                                • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 007DE727
                                                                • SetActiveWindow.USER32 ref: 007DE746
                                                                • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 007DE754
                                                                • SendMessageW.USER32(00000010,00000000,00000000), ref: 007DE773
                                                                • Sleep.KERNEL32(000000FA), ref: 007DE77E
                                                                • IsWindow.USER32 ref: 007DE78A
                                                                • EndDialog.USER32(00000000), ref: 007DE79B
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                • String ID: BUTTON
                                                                • API String ID: 1194449130-3405671355
                                                                • Opcode ID: 482134a446abd9b83a1c912cb95235915f4fc6ddb6a9668f8347dca3095e34ca
                                                                • Instruction ID: c1cb124f92c73b5c7b4e172691b1736bda87216f8115b3159d2189886059819f
                                                                • Opcode Fuzzy Hash: 482134a446abd9b83a1c912cb95235915f4fc6ddb6a9668f8347dca3095e34ca
                                                                • Instruction Fuzzy Hash: 4321A874204204AFEB51AFA0ECCDA363B79F765358F504526F415853B1DB79AC00CB65
                                                                Function 007DE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 007DEA5D
                                                                • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 007DEA73
                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007DEA84
                                                                • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 007DEA96
                                                                • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 007DEAA7
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: SendString$_wcslen
                                                                • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                • API String ID: 2420728520-1007645807
                                                                • Opcode ID: b137e6c84b1f23986a404963c4d466166c89ebe1a71652fe73514e7c13efed40
                                                                • Instruction ID: e776966f3e5536350e8da9d407de714854cf176a00417d0c08ba334150477d96
                                                                • Opcode Fuzzy Hash: b137e6c84b1f23986a404963c4d466166c89ebe1a71652fe73514e7c13efed40
                                                                • Instruction Fuzzy Hash: 6F119131A90219B9DB21B7A5DD4AEFF6A7CFBD2B40F00842A7825E61D0EE781915C5F0
                                                                Function 007D9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetKeyboardState.USER32(?), ref: 007DA012
                                                                • SetKeyboardState.USER32(?), ref: 007DA07D
                                                                • GetAsyncKeyState.USER32(000000A0), ref: 007DA09D
                                                                • GetKeyState.USER32(000000A0), ref: 007DA0B4
                                                                • GetAsyncKeyState.USER32(000000A1), ref: 007DA0E3
                                                                • GetKeyState.USER32(000000A1), ref: 007DA0F4
                                                                • GetAsyncKeyState.USER32(00000011), ref: 007DA120
                                                                • GetKeyState.USER32(00000011), ref: 007DA12E
                                                                • GetAsyncKeyState.USER32(00000012), ref: 007DA157
                                                                • GetKeyState.USER32(00000012), ref: 007DA165
                                                                • GetAsyncKeyState.USER32(0000005B), ref: 007DA18E
                                                                • GetKeyState.USER32(0000005B), ref: 007DA19C
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: State$Async$Keyboard
                                                                • String ID:
                                                                • API String ID: 541375521-0
                                                                • Opcode ID: 8e93fa20356b53e96e6eccec90230cfc92e4e0b93821a076eb5b2af6534ce1df
                                                                • Instruction ID: a8b169a7069683dafa9d5a2b35e7bc6788b6a5444540840165c6e9fec156d501
                                                                • Opcode Fuzzy Hash: 8e93fa20356b53e96e6eccec90230cfc92e4e0b93821a076eb5b2af6534ce1df
                                                                • Instruction Fuzzy Hash: 9C51CB2190478879FB35EB7088557EABFB5AF12340F08459BD5C2573C2EA5CAA4CC763
                                                                Function 007D5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDlgItem.USER32(?,00000001), ref: 007D5CE2
                                                                • GetWindowRect.USER32(00000000,?), ref: 007D5CFB
                                                                • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 007D5D59
                                                                • GetDlgItem.USER32(?,00000002), ref: 007D5D69
                                                                • GetWindowRect.USER32(00000000,?), ref: 007D5D7B
                                                                • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 007D5DCF
                                                                • GetDlgItem.USER32(?,000003E9), ref: 007D5DDD
                                                                • GetWindowRect.USER32(00000000,?), ref: 007D5DEF
                                                                • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 007D5E31
                                                                • GetDlgItem.USER32(?,000003EA), ref: 007D5E44
                                                                • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 007D5E5A
                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 007D5E67
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ItemMoveRect$Invalidate
                                                                • String ID:
                                                                • API String ID: 3096461208-0
                                                                • Opcode ID: 4603cb51c4615390d778bdd6ae1d0f1eacf7076cca79b57a5d6fcc6d6974b78b
                                                                • Instruction ID: cb2a4c621c51d0a2b86cef6fe5ebeaca7346385bf18b86fc3820ab4b606bb901
                                                                • Opcode Fuzzy Hash: 4603cb51c4615390d778bdd6ae1d0f1eacf7076cca79b57a5d6fcc6d6974b78b
                                                                • Instruction Fuzzy Hash: 20510E71B00609AFDF18DF68DD89AAEBBB6FB58301F148229F515E7290D7749E04CB60
                                                                Function 00788BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00788F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00788BE8,?,00000000,?,?,?,?,00788BBA,00000000,?), ref: 00788FC5
                                                                • DestroyWindow.USER32(?), ref: 00788C81
                                                                • KillTimer.USER32(00000000,?,?,?,?,00788BBA,00000000,?), ref: 00788D1B
                                                                • DestroyAcceleratorTable.USER32(00000000), ref: 007C6973
                                                                • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00788BBA,00000000,?), ref: 007C69A1
                                                                • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00788BBA,00000000,?), ref: 007C69B8
                                                                • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00788BBA,00000000), ref: 007C69D4
                                                                • DeleteObject.GDI32(00000000), ref: 007C69E6
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                • String ID:
                                                                • API String ID: 641708696-0
                                                                • Opcode ID: 674dc178d8b1f8f4cc8bd7ecad4a0963ee3331a5387fd9b11cedb95efc42b3a6
                                                                • Instruction ID: a8ec9afbd607045c38f34694dad961b4567d23894d164810028f22096384c67e
                                                                • Opcode Fuzzy Hash: 674dc178d8b1f8f4cc8bd7ecad4a0963ee3331a5387fd9b11cedb95efc42b3a6
                                                                • Instruction Fuzzy Hash: EE61A035141600DFDB61AF14D98CB29BBF1FB45312F94865CE042976A4CB39ADC0CF62
                                                                Function 00789838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789944: GetWindowLongW.USER32(?,000000EB), ref: 00789952
                                                                • GetSysColor.USER32(0000000F), ref: 00789862
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ColorLongWindow
                                                                • String ID:
                                                                • API String ID: 259745315-0
                                                                • Opcode ID: 0f2f53ccb2aa90d165ab1c886d9d8a972be3180311e76ea4a3cbb8f309bec8c2
                                                                • Instruction ID: d3a0f6f26c089fc3480ca70186293d99cbd657bb0e2d1e515a00e6acbeede648
                                                                • Opcode Fuzzy Hash: 0f2f53ccb2aa90d165ab1c886d9d8a972be3180311e76ea4a3cbb8f309bec8c2
                                                                • Instruction Fuzzy Hash: E441C331184740AFDB246F389C88BB93BA5FB46330F184719FAA2871E1D7399C42DB10
                                                                Function 007A8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: .y
                                                                • API String ID: 0-2155845462
                                                                • Opcode ID: c745de89e85114623adbef3db85eebea6767397376a4de4dba41c35147959639
                                                                • Instruction ID: e776413c48aa4e4d2570dbaaa9a3b3c11362f526d636b7a53da1f1bf88591042
                                                                • Opcode Fuzzy Hash: c745de89e85114623adbef3db85eebea6767397376a4de4dba41c35147959639
                                                                • Instruction Fuzzy Hash: A9C1E77590424ADFCF51DFA8D845BAEBBB0BF8B310F144299F614A7392C7389941CB61
                                                                Function 007D96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,007BF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 007D9717
                                                                • LoadStringW.USER32(00000000,?,007BF7F8,00000001), ref: 007D9720
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,007BF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 007D9742
                                                                • LoadStringW.USER32(00000000,?,007BF7F8,00000001), ref: 007D9745
                                                                • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 007D9866
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: HandleLoadModuleString$Message_wcslen
                                                                • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                • API String ID: 747408836-2268648507
                                                                • Opcode ID: ad2df7177e402d2774b8c7ae4f746240134fff91593112ebd553b102ecfd97bd
                                                                • Instruction ID: 5faf33e88d0f5f5a5281b839d75cf145de27ba977088d3d09cd88b6ef0b107bf
                                                                • Opcode Fuzzy Hash: ad2df7177e402d2774b8c7ae4f746240134fff91593112ebd553b102ecfd97bd
                                                                • Instruction Fuzzy Hash: D4412E72900209EACF14EBE0CD5ADEEB778EF55780F508125F60972192EA396F48DB61
                                                                Function 007D06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00776B57: _wcslen.LIBCMT ref: 00776B6A
                                                                • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007D07A2
                                                                • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007D07BE
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007D07DA
                                                                • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 007D0804
                                                                • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 007D082C
                                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 007D0837
                                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 007D083C
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                                • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                • API String ID: 323675364-22481851
                                                                • Opcode ID: 7d4271c882c04a7d2c95bfee4211f9adac21ab8b699d17889d1889b5c810e9f8
                                                                • Instruction ID: 3c9b776328673bd4760f5b9322beacf0b7973de5127a6fcab8dd5bccb98530ab
                                                                • Opcode Fuzzy Hash: 7d4271c882c04a7d2c95bfee4211f9adac21ab8b699d17889d1889b5c810e9f8
                                                                • Instruction Fuzzy Hash: E141F772810629EBDF15EFA4DC89DEDB778FF44390F148129E915A72A1EB385E04CB90
                                                                Function 00803F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0080403B
                                                                • CreateCompatibleDC.GDI32(00000000), ref: 00804042
                                                                • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00804055
                                                                • SelectObject.GDI32(00000000,00000000), ref: 0080405D
                                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 00804068
                                                                • DeleteDC.GDI32(00000000), ref: 00804072
                                                                • GetWindowLongW.USER32(?,000000EC), ref: 0080407C
                                                                • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00804092
                                                                • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 0080409E
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                • String ID: static
                                                                • API String ID: 2559357485-2160076837
                                                                • Opcode ID: de5ee8df7494e1977cdcaf4d863b34593bbdb873b9ba75d0d8f86f93f79ab185
                                                                • Instruction ID: 699ff30f327480fb6c812c4c7eb79684fdedc68fc61c9436c0ba0305ce7bd365
                                                                • Opcode Fuzzy Hash: de5ee8df7494e1977cdcaf4d863b34593bbdb873b9ba75d0d8f86f93f79ab185
                                                                • Instruction Fuzzy Hash: 58315772141219ABDFA29FA8CC08FDA3B68FF09320F100310FA69E61E0CB75D861DB50
                                                                Function 007F3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(?), ref: 007F3C5C
                                                                • CoInitialize.OLE32(00000000), ref: 007F3C8A
                                                                • CoUninitialize.OLE32 ref: 007F3C94
                                                                • _wcslen.LIBCMT ref: 007F3D2D
                                                                • GetRunningObjectTable.OLE32(00000000,?), ref: 007F3DB1
                                                                • SetErrorMode.KERNEL32(00000001,00000029), ref: 007F3ED5
                                                                • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 007F3F0E
                                                                • CoGetObject.OLE32(?,00000000,0080FB98,?), ref: 007F3F2D
                                                                • SetErrorMode.KERNEL32(00000000), ref: 007F3F40
                                                                • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 007F3FC4
                                                                • VariantClear.OLEAUT32(?), ref: 007F3FD8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                                • String ID:
                                                                • API String ID: 429561992-0
                                                                • Opcode ID: 1459192cd7989f83e04888a356c82e1549b2e8c3ef106688682456edf6d02731
                                                                • Instruction ID: a3ee6914274b69bdf9191159f5b4fb2d5c8b6f8a28d564dcd065e9fcc2a847a5
                                                                • Opcode Fuzzy Hash: 1459192cd7989f83e04888a356c82e1549b2e8c3ef106688682456edf6d02731
                                                                • Instruction Fuzzy Hash: ABC124716082099FD700DF68C88492BB7E9FF89758F10491DFA8A9B351D735EE05CB52
                                                                Function 007E7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CoInitialize.OLE32(00000000), ref: 007E7AF3
                                                                • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 007E7B8F
                                                                • SHGetDesktopFolder.SHELL32(?), ref: 007E7BA3
                                                                • CoCreateInstance.OLE32(0080FD08,00000000,00000001,00836E6C,?), ref: 007E7BEF
                                                                • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 007E7C74
                                                                • CoTaskMemFree.OLE32(?,?), ref: 007E7CCC
                                                                • SHBrowseForFolderW.SHELL32(?), ref: 007E7D57
                                                                • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007E7D7A
                                                                • CoTaskMemFree.OLE32(00000000), ref: 007E7D81
                                                                • CoTaskMemFree.OLE32(00000000), ref: 007E7DD6
                                                                • CoUninitialize.OLE32 ref: 007E7DDC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                                • String ID:
                                                                • API String ID: 2762341140-0
                                                                • Opcode ID: 8f50e0f54aa7a233151598e45daa6aeea0ce7a41ab6bd8d35374a09718a8807e
                                                                • Instruction ID: d2730d390828ab9f8f56b1b8da22083b9aab0551c37677c73262c35b6f45b984
                                                                • Opcode Fuzzy Hash: 8f50e0f54aa7a233151598e45daa6aeea0ce7a41ab6bd8d35374a09718a8807e
                                                                • Instruction Fuzzy Hash: 66C13975A05149EFCB14DFA5C888DAEBBF9FF48304B1485A8E819DB261D734EE41CB90
                                                                Function 0080541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00805504
                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00805515
                                                                • CharNextW.USER32(00000158), ref: 00805544
                                                                • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00805585
                                                                • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0080559B
                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008055AC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CharNext
                                                                • String ID:
                                                                • API String ID: 1350042424-0
                                                                • Opcode ID: 6537b1af956088be8250d961039c5736c101930fedc05278ae232fee722a524a
                                                                • Instruction ID: a963c41caa23c725771cd6861fd010ad6a41d3da77b8cc4bb2443f741462109b
                                                                • Opcode Fuzzy Hash: 6537b1af956088be8250d961039c5736c101930fedc05278ae232fee722a524a
                                                                • Instruction Fuzzy Hash: 86615875901A08AADFA09F54CC84AFF7BB9FB09724F104149F925EA2D0D7749A81DF70
                                                                Function 007CFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 007CFAAF
                                                                • SafeArrayAllocData.OLEAUT32(?), ref: 007CFB08
                                                                • VariantInit.OLEAUT32(?), ref: 007CFB1A
                                                                • SafeArrayAccessData.OLEAUT32(?,?), ref: 007CFB3A
                                                                • VariantCopy.OLEAUT32(?,?), ref: 007CFB8D
                                                                • SafeArrayUnaccessData.OLEAUT32(?), ref: 007CFBA1
                                                                • VariantClear.OLEAUT32(?), ref: 007CFBB6
                                                                • SafeArrayDestroyData.OLEAUT32(?), ref: 007CFBC3
                                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007CFBCC
                                                                • VariantClear.OLEAUT32(?), ref: 007CFBDE
                                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007CFBE9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                • String ID:
                                                                • API String ID: 2706829360-0
                                                                • Opcode ID: 6183aee371af5f57b40d506a68b691ae9c1fd4ebc03255f24e67fdd5c24f02c0
                                                                • Instruction ID: 6cdf9c63916a4d0e6be1ce7ff3dafd3b52a5f54cac4fb8585ab8ed3fd502dd04
                                                                • Opcode Fuzzy Hash: 6183aee371af5f57b40d506a68b691ae9c1fd4ebc03255f24e67fdd5c24f02c0
                                                                • Instruction Fuzzy Hash: 49413E75A00219EFCB00DF64D858EAEBBBAFF48354F00816DE945A7261CB34AD45CBA0
                                                                Function 007D9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetKeyboardState.USER32(?), ref: 007D9CA1
                                                                • GetAsyncKeyState.USER32(000000A0), ref: 007D9D22
                                                                • GetKeyState.USER32(000000A0), ref: 007D9D3D
                                                                • GetAsyncKeyState.USER32(000000A1), ref: 007D9D57
                                                                • GetKeyState.USER32(000000A1), ref: 007D9D6C
                                                                • GetAsyncKeyState.USER32(00000011), ref: 007D9D84
                                                                • GetKeyState.USER32(00000011), ref: 007D9D96
                                                                • GetAsyncKeyState.USER32(00000012), ref: 007D9DAE
                                                                • GetKeyState.USER32(00000012), ref: 007D9DC0
                                                                • GetAsyncKeyState.USER32(0000005B), ref: 007D9DD8
                                                                • GetKeyState.USER32(0000005B), ref: 007D9DEA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: State$Async$Keyboard
                                                                • String ID:
                                                                • API String ID: 541375521-0
                                                                • Opcode ID: 13d7789ba3a03e25e2f5a663f5237d78948fbf81a47ea200648b19a1343e7f6f
                                                                • Instruction ID: bad5cd5e0a10dbfa93d92d6984130977548ff62d7aaec10aeb20e24807212a8d
                                                                • Opcode Fuzzy Hash: 13d7789ba3a03e25e2f5a663f5237d78948fbf81a47ea200648b19a1343e7f6f
                                                                • Instruction Fuzzy Hash: 574195346047C969FF719B7488043B5BEB17B21344F08815BDBCA567C2EBAD99C8C7A2
                                                                Function 007F055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • WSAStartup.WSOCK32(00000101,?), ref: 007F05BC
                                                                • inet_addr.WSOCK32(?), ref: 007F061C
                                                                • gethostbyname.WSOCK32(?), ref: 007F0628
                                                                • IcmpCreateFile.IPHLPAPI ref: 007F0636
                                                                • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007F06C6
                                                                • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007F06E5
                                                                • IcmpCloseHandle.IPHLPAPI(?), ref: 007F07B9
                                                                • WSACleanup.WSOCK32 ref: 007F07BF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                • String ID: Ping
                                                                • API String ID: 1028309954-2246546115
                                                                • Opcode ID: f45dfad46e12da95429aeee75c4bcad7846f07fd60fc0c33731b93b3e7f08d8b
                                                                • Instruction ID: b15d63156a54ab23f27ea9b7eec30bc1b5e5373d9580ddfed429e39e9fc7f293
                                                                • Opcode Fuzzy Hash: f45dfad46e12da95429aeee75c4bcad7846f07fd60fc0c33731b93b3e7f08d8b
                                                                • Instruction Fuzzy Hash: BD916A75608205DFDB20DF19C488F2ABBE0AF48318F1485A9E5698B7A2C778ED41CFD1
                                                                Function 007F8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharLower
                                                                • String ID: cdecl$none$stdcall$winapi
                                                                • API String ID: 707087890-567219261
                                                                • Opcode ID: d931ea5f0850bb428c6d45ce9a8783e43430131baef72303c81d943d721b8d8a
                                                                • Instruction ID: 375b2f11c821edd7214fded223bc36433e444ea8a8a67550de019b9e8b2b4cfc
                                                                • Opcode Fuzzy Hash: d931ea5f0850bb428c6d45ce9a8783e43430131baef72303c81d943d721b8d8a
                                                                • Instruction Fuzzy Hash: F951C432A0051AEBCF54DF6CC9519BEB3A5BF64360B204229E625E73C4EB38DD40C791
                                                                Function 007F372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CoInitialize.OLE32 ref: 007F3774
                                                                • CoUninitialize.OLE32 ref: 007F377F
                                                                • CoCreateInstance.OLE32(?,00000000,00000017,0080FB78,?), ref: 007F37D9
                                                                • IIDFromString.OLE32(?,?), ref: 007F384C
                                                                • VariantInit.OLEAUT32(?), ref: 007F38E4
                                                                • VariantClear.OLEAUT32(?), ref: 007F3936
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                                • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                • API String ID: 636576611-1287834457
                                                                • Opcode ID: dcd7b23c395964a2278ca72c58e01a7b5ed47ee3fcec80e9c1fab09a94868a21
                                                                • Instruction ID: f8d774c7350bd9fb4f153d4a5bb3fc14d7e00be03021479b5796b73c4f07a97f
                                                                • Opcode Fuzzy Hash: dcd7b23c395964a2278ca72c58e01a7b5ed47ee3fcec80e9c1fab09a94868a21
                                                                • Instruction Fuzzy Hash: B3618CB0608305AFD710EF54C889B6AB7E4EF48754F104919FA959B391C778EE48CBA2
                                                                Function 007E3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 007E33CF
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 007E33F0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: LoadString$_wcslen
                                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                • API String ID: 4099089115-3080491070
                                                                • Opcode ID: af677b8cfc26eab5795fbb12ead2320eacff486a02abbe44b5ba860449bcf8d2
                                                                • Instruction ID: 0b47d806c4e2f05f256eb8de886b8021714898a261f302cb350ff8164f3999b3
                                                                • Opcode Fuzzy Hash: af677b8cfc26eab5795fbb12ead2320eacff486a02abbe44b5ba860449bcf8d2
                                                                • Instruction Fuzzy Hash: DF519071901209EADF15EBA0CD4AEEEB778FF15380F108165F50972292EB392F58DB61
                                                                Function 007DB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharUpper
                                                                • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                                • API String ID: 1256254125-769500911
                                                                • Opcode ID: 0d0d904a4770c7558c36940b075f02a45a627260e4705a449d4998634c0b7071
                                                                • Instruction ID: 467568797185f9e6842b777dd26177d5ef021c192a9c4528b5561b982b0f4378
                                                                • Opcode Fuzzy Hash: 0d0d904a4770c7558c36940b075f02a45a627260e4705a449d4998634c0b7071
                                                                • Instruction Fuzzy Hash: 4841C332A00026DBCB205F7D88905BE77B5BBA4BA4B26422BE521D7384F739DD81C790
                                                                Function 007E5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetErrorMode.KERNEL32(00000001), ref: 007E53A0
                                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 007E5416
                                                                • GetLastError.KERNEL32 ref: 007E5420
                                                                • SetErrorMode.KERNEL32(00000000,READY), ref: 007E54A7
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                • API String ID: 4194297153-14809454
                                                                • Opcode ID: 4ad0dd1dc6c5be477a6795aa1e16bfa806828687745c32314e4037406e2b0ed4
                                                                • Instruction ID: 70fceca2fe51d809b1c4ac991f41dab3c9369ed3a1d416162f259c59929ec4a5
                                                                • Opcode Fuzzy Hash: 4ad0dd1dc6c5be477a6795aa1e16bfa806828687745c32314e4037406e2b0ed4
                                                                • Instruction Fuzzy Hash: B131D375A01188DFCB10DF69C488AA9BBF4FF4A309F148165E505CB292D779DD86CB90
                                                                Function 00803C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateMenu.USER32 ref: 00803C79
                                                                • SetMenu.USER32(?,00000000), ref: 00803C88
                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00803D10
                                                                • IsMenu.USER32(?), ref: 00803D24
                                                                • CreatePopupMenu.USER32 ref: 00803D2E
                                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00803D5B
                                                                • DrawMenuBar.USER32 ref: 00803D63
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                • String ID: 0$F
                                                                • API String ID: 161812096-3044882817
                                                                • Opcode ID: 09a56a6d17faba12cab4c9fa3f01fcc8f561a63cda5d3d54e3c41f00319d750f
                                                                • Instruction ID: 5645109170c59be40314a96dee861d88775fbaaff55bda139dbd0b2f55545fba
                                                                • Opcode Fuzzy Hash: 09a56a6d17faba12cab4c9fa3f01fcc8f561a63cda5d3d54e3c41f00319d750f
                                                                • Instruction Fuzzy Hash: 3B413A79A01209EFDF54CF64DC44AAA7BB9FF49350F140129ED46E73A0D770AA10DB94
                                                                Function 007D1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 007D3CCA
                                                                • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 007D1F64
                                                                • GetDlgCtrlID.USER32 ref: 007D1F6F
                                                                • GetParent.USER32 ref: 007D1F8B
                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 007D1F8E
                                                                • GetDlgCtrlID.USER32(?), ref: 007D1F97
                                                                • GetParent.USER32(?), ref: 007D1FAB
                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 007D1FAE
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 711023334-1403004172
                                                                • Opcode ID: 0d30347a88f999370fcada69181f4989d148ba16efd7473cc7a5652524e8434e
                                                                • Instruction ID: 62833fc07cabff5979fb219ae1b5d823c85c97b01396a7cacf820f1dbd1995b8
                                                                • Opcode Fuzzy Hash: 0d30347a88f999370fcada69181f4989d148ba16efd7473cc7a5652524e8434e
                                                                • Instruction Fuzzy Hash: 9F21B070A01214BBCF15AFA0CC89DEEBBB8FF15350F40465AB965A7291DB3959089B60
                                                                Function 007D1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 007D3CCA
                                                                • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 007D2043
                                                                • GetDlgCtrlID.USER32 ref: 007D204E
                                                                • GetParent.USER32 ref: 007D206A
                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 007D206D
                                                                • GetDlgCtrlID.USER32(?), ref: 007D2076
                                                                • GetParent.USER32(?), ref: 007D208A
                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 007D208D
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 711023334-1403004172
                                                                • Opcode ID: 748b2e2542a3efb0ad1fc2b5000c8ddd0b338fc207e165608a8b21cb6cb7c2de
                                                                • Instruction ID: cbc1f0b2440ac9c306e43ec67e86cbec20e7e449103ce07df757a1fa281d3b1a
                                                                • Opcode Fuzzy Hash: 748b2e2542a3efb0ad1fc2b5000c8ddd0b338fc207e165608a8b21cb6cb7c2de
                                                                • Instruction Fuzzy Hash: AE21D471A01214BBCF10AFA0CC49EEEBBB8FF25340F104516B965A72A1DB794916DB70
                                                                Function 00803A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00803A9D
                                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00803AA0
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00803AC7
                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00803AEA
                                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00803B62
                                                                • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00803BAC
                                                                • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00803BC7
                                                                • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00803BE2
                                                                • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00803BF6
                                                                • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00803C13
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$LongWindow
                                                                • String ID:
                                                                • API String ID: 312131281-0
                                                                • Opcode ID: e03a3ad413b6f5de6145f02cf2fa3f7f0e003378c265838d5fffa46161b80649
                                                                • Instruction ID: aa3a6c9a8720e31cc0c94ca82d252f189a56b9f38cfc44d369811b291f869add
                                                                • Opcode Fuzzy Hash: e03a3ad413b6f5de6145f02cf2fa3f7f0e003378c265838d5fffa46161b80649
                                                                • Instruction Fuzzy Hash: A3617975A00208AFDB21DFA8CC85EEE77B8FB09714F100199FA15E72E1D774AA81DB50
                                                                Function 007DB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentThreadId.KERNEL32 ref: 007DB151
                                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,?,007DA1E1,?,00000001), ref: 007DB165
                                                                • GetWindowThreadProcessId.USER32(00000000), ref: 007DB16C
                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007DA1E1,?,00000001), ref: 007DB17B
                                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 007DB18D
                                                                • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,007DA1E1,?,00000001), ref: 007DB1A6
                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007DA1E1,?,00000001), ref: 007DB1B8
                                                                • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,007DA1E1,?,00000001), ref: 007DB1FD
                                                                • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,007DA1E1,?,00000001), ref: 007DB212
                                                                • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,007DA1E1,?,00000001), ref: 007DB21D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                • String ID:
                                                                • API String ID: 2156557900-0
                                                                • Opcode ID: d1ab89e809f9b4b77134075b6fb3283e7b889cb991430617985ff13434feca82
                                                                • Instruction ID: c81e0c92b711df5b676c08ee625ff8d5287f9089bf355b0d5a61fa2d01ea8f37
                                                                • Opcode Fuzzy Hash: d1ab89e809f9b4b77134075b6fb3283e7b889cb991430617985ff13434feca82
                                                                • Instruction Fuzzy Hash: 3B31A576500604FFDB209F64EC84B6D7BB9BB52355F11420AFA11D6290E7B9AD40CF70
                                                                Function 007A2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _free.LIBCMT ref: 007A2C94
                                                                  • Part of subcall function 007A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000), ref: 007A29DE
                                                                  • Part of subcall function 007A29C8: GetLastError.KERNEL32(00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000,00000000), ref: 007A29F0
                                                                • _free.LIBCMT ref: 007A2CA0
                                                                • _free.LIBCMT ref: 007A2CAB
                                                                • _free.LIBCMT ref: 007A2CB6
                                                                • _free.LIBCMT ref: 007A2CC1
                                                                • _free.LIBCMT ref: 007A2CCC
                                                                • _free.LIBCMT ref: 007A2CD7
                                                                • _free.LIBCMT ref: 007A2CE2
                                                                • _free.LIBCMT ref: 007A2CED
                                                                • _free.LIBCMT ref: 007A2CFB
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast
                                                                • String ID:
                                                                • API String ID: 776569668-0
                                                                • Opcode ID: f37af312a0c4c33c0a984dd5f416d4187307648b1b8c50e0cb029a96478916c7
                                                                • Instruction ID: 3f28ff0e719fe3335d9dbf946b50c22f2984387d14e981bcf3ce050d9d1ce337
                                                                • Opcode Fuzzy Hash: f37af312a0c4c33c0a984dd5f416d4187307648b1b8c50e0cb029a96478916c7
                                                                • Instruction Fuzzy Hash: 5A11C676100108EFCB42EF58D846CDE3BA5FF46750F5146A0FA48AB232D635FA519FA1
                                                                Function 007E7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007E7FAD
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 007E7FC1
                                                                • GetFileAttributesW.KERNEL32(?), ref: 007E7FEB
                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 007E8005
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 007E8017
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 007E8060
                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 007E80B0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CurrentDirectory$AttributesFile
                                                                • String ID: *.*
                                                                • API String ID: 769691225-438819550
                                                                • Opcode ID: dd33a42ef83f0cb0c4380bdf7ef3718b2a2de4a651bbb238e62eb9318f7db53a
                                                                • Instruction ID: ac4239f0f8d464ff0bb3b4c9ce477ca01a956e1d31f6b9832e29a571c7e45e71
                                                                • Opcode Fuzzy Hash: dd33a42ef83f0cb0c4380bdf7ef3718b2a2de4a651bbb238e62eb9318f7db53a
                                                                • Instruction Fuzzy Hash: 7B81A1725092819BCB28EF16C4459AEB3E8BF8C314F544C5EF889D7250EB39DD45CB52
                                                                Function 00775BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetWindowLongW.USER32(?,000000EB), ref: 00775C7A
                                                                  • Part of subcall function 00775D0A: GetClientRect.USER32(?,?), ref: 00775D30
                                                                  • Part of subcall function 00775D0A: GetWindowRect.USER32(?,?), ref: 00775D71
                                                                  • Part of subcall function 00775D0A: ScreenToClient.USER32(?,?), ref: 00775D99
                                                                • GetDC.USER32 ref: 007B46F5
                                                                • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 007B4708
                                                                • SelectObject.GDI32(00000000,00000000), ref: 007B4716
                                                                • SelectObject.GDI32(00000000,00000000), ref: 007B472B
                                                                • ReleaseDC.USER32(?,00000000), ref: 007B4733
                                                                • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 007B47C4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                • String ID: U
                                                                • API String ID: 4009187628-3372436214
                                                                • Opcode ID: 633bb2f1b846a57bdf740db4a3c807b741912a619cb15578121083a245fb3202
                                                                • Instruction ID: 3185df4f664c190fcf6e32ec0795424418ad54c25d88ecb7532e44e7e365e3bd
                                                                • Opcode Fuzzy Hash: 633bb2f1b846a57bdf740db4a3c807b741912a619cb15578121083a245fb3202
                                                                • Instruction Fuzzy Hash: 8B710030400205EFCF228F64C985BFA3BB5FF4A364F144269ED559A2A7CB398881DF60
                                                                Function 007E359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007E35E4
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • LoadStringW.USER32(00842390,?,00000FFF,?), ref: 007E360A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: LoadString$_wcslen
                                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                • API String ID: 4099089115-2391861430
                                                                • Opcode ID: 12f5d85cc1951b18a520ab320b2f9b1feeb9512209a78f1d9617955295796f65
                                                                • Instruction ID: 59b5c0ad7650770c16e777236b4d609f79d4692c0545fb1c787962f719b9087b
                                                                • Opcode Fuzzy Hash: 12f5d85cc1951b18a520ab320b2f9b1feeb9512209a78f1d9617955295796f65
                                                                • Instruction Fuzzy Hash: 7B515E71801249FADF15EBA0CC4AEEDBB74FF15340F148125F619721A1EB391A98DFA1
                                                                Function 00808B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                  • Part of subcall function 0078912D: GetCursorPos.USER32(?), ref: 00789141
                                                                  • Part of subcall function 0078912D: ScreenToClient.USER32(00000000,?), ref: 0078915E
                                                                  • Part of subcall function 0078912D: GetAsyncKeyState.USER32(00000001), ref: 00789183
                                                                  • Part of subcall function 0078912D: GetAsyncKeyState.USER32(00000002), ref: 0078919D
                                                                • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00808B6B
                                                                • ImageList_EndDrag.COMCTL32 ref: 00808B71
                                                                • ReleaseCapture.USER32 ref: 00808B77
                                                                • SetWindowTextW.USER32(?,00000000), ref: 00808C12
                                                                • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00808C25
                                                                • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00808CFF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                • API String ID: 1924731296-2107944366
                                                                • Opcode ID: 3b0b5d90d3ceb6ae0709778466317405b85c4d5cd6cc9b829743aa915170416d
                                                                • Instruction ID: 9b80033909e3dee973e54e2281db6a0433d84ac75dca6222a022437348b0c557
                                                                • Opcode Fuzzy Hash: 3b0b5d90d3ceb6ae0709778466317405b85c4d5cd6cc9b829743aa915170416d
                                                                • Instruction Fuzzy Hash: 4C519C70205204EFEB40DF24CC5AFAA7BE4FB89754F40062DFA96972E1CB749944CB62
                                                                Function 007EC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007EC272
                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007EC29A
                                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 007EC2CA
                                                                • GetLastError.KERNEL32 ref: 007EC322
                                                                • SetEvent.KERNEL32(?), ref: 007EC336
                                                                • InternetCloseHandle.WININET(00000000), ref: 007EC341
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                • String ID:
                                                                • API String ID: 3113390036-3916222277
                                                                • Opcode ID: b09b5afa257903675db8771e36b65af2761366634d54097665e26de11dab028f
                                                                • Instruction ID: 004abe6c9ee5c19ca0fa68d6e01143608f99c6c6cd0cfa2fa93399d652d52964
                                                                • Opcode Fuzzy Hash: b09b5afa257903675db8771e36b65af2761366634d54097665e26de11dab028f
                                                                • Instruction Fuzzy Hash: 9A31A0B5501284AFD7229F668C88AAB7BFCFB4D744F14851DF446D3200DB38DD068B61
                                                                Function 007D989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,007B3AAF,?,?,Bad directive syntax error,0080CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 007D98BC
                                                                • LoadStringW.USER32(00000000,?,007B3AAF,?), ref: 007D98C3
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 007D9987
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: HandleLoadMessageModuleString_wcslen
                                                                • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                • API String ID: 858772685-4153970271
                                                                • Opcode ID: b582b13a0e89c68e9d96831fe604b3e25aa99ae48cbbfcdd4d1d250fd3818f46
                                                                • Instruction ID: 211d4ba1715fdc60672dbb9594af5ff2b05e38de6ed9b96e80a0d1cb66d534f5
                                                                • Opcode Fuzzy Hash: b582b13a0e89c68e9d96831fe604b3e25aa99ae48cbbfcdd4d1d250fd3818f46
                                                                • Instruction Fuzzy Hash: 85218631C00219FBCF15AF90CC1AEEE7779FF14340F048466F619661A1EB79A628DB51
                                                                Function 007D209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetParent.USER32 ref: 007D20AB
                                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 007D20C0
                                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 007D214D
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameParentSend
                                                                • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                • API String ID: 1290815626-3381328864
                                                                • Opcode ID: be58824bccadc660a1769114616573c43cd7fab8b1aae9c95a25bce1e7d8c89c
                                                                • Instruction ID: 4be00bba7728416f374f67791df86eb225a1e38462eba671e026f4c5bbb371f1
                                                                • Opcode Fuzzy Hash: be58824bccadc660a1769114616573c43cd7fab8b1aae9c95a25bce1e7d8c89c
                                                                • Instruction Fuzzy Hash: D611E77668470AB9FA112624AC0ADA677ACEF24734F208217F704E52D2FA6E58035654
                                                                Function 007ACE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                                • String ID:
                                                                • API String ID: 1282221369-0
                                                                • Opcode ID: 4a483dfc891a44862d1735f82b3dc5eefb40d4be25cb2af4ab675b360681f24b
                                                                • Instruction ID: 447e7e78a774a5a57d2f27eb318a55a52659cc9b57d4b302de0bbae0af4baaa9
                                                                • Opcode Fuzzy Hash: 4a483dfc891a44862d1735f82b3dc5eefb40d4be25cb2af4ab675b360681f24b
                                                                • Instruction Fuzzy Hash: ED613973904200FFDF26AFB8984976A7B95AF87320F04436DFA55A7242D63D9D01CB50
                                                                Function 00788B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 007C6890
                                                                • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 007C68A9
                                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 007C68B9
                                                                • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 007C68D1
                                                                • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 007C68F2
                                                                • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00788874,00000000,00000000,00000000,000000FF,00000000), ref: 007C6901
                                                                • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 007C691E
                                                                • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00788874,00000000,00000000,00000000,000000FF,00000000), ref: 007C692D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                • String ID:
                                                                • API String ID: 1268354404-0
                                                                • Opcode ID: 464266b508f5d38e9470413934925cf61716879abea773da968992b393809640
                                                                • Instruction ID: 2f521138f7a5dc72e2ad9eefe15b38fbaf61bc12366e74551a59a78ebd6aeb55
                                                                • Opcode Fuzzy Hash: 464266b508f5d38e9470413934925cf61716879abea773da968992b393809640
                                                                • Instruction Fuzzy Hash: 9F518AB0640209EFDB60EF24CC95FAA7BB5FB98750F10461CF916972A0DB78E990DB50
                                                                Function 007EC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007EC182
                                                                • GetLastError.KERNEL32 ref: 007EC195
                                                                • SetEvent.KERNEL32(?), ref: 007EC1A9
                                                                  • Part of subcall function 007EC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007EC272
                                                                  • Part of subcall function 007EC253: GetLastError.KERNEL32 ref: 007EC322
                                                                  • Part of subcall function 007EC253: SetEvent.KERNEL32(?), ref: 007EC336
                                                                  • Part of subcall function 007EC253: InternetCloseHandle.WININET(00000000), ref: 007EC341
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                                • String ID:
                                                                • API String ID: 337547030-0
                                                                • Opcode ID: 4829ae913a1884b7fba43a8154d6c2f820d62f1e1930afecc7a592dd49e1c077
                                                                • Instruction ID: 50b425e1c92e36a9966a22f3a9e5c551372eb86243fbbeb728623c36e17bc417
                                                                • Opcode Fuzzy Hash: 4829ae913a1884b7fba43a8154d6c2f820d62f1e1930afecc7a592dd49e1c077
                                                                • Instruction Fuzzy Hash: 4A318F79202685EFDB229FAADC44A76BBFDFF1C300B04451DFA5686610D738E8169B60
                                                                Function 007D25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 007D3A57
                                                                  • Part of subcall function 007D3A3D: GetCurrentThreadId.KERNEL32 ref: 007D3A5E
                                                                  • Part of subcall function 007D3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007D25B3), ref: 007D3A65
                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 007D25BD
                                                                • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 007D25DB
                                                                • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 007D25DF
                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 007D25E9
                                                                • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 007D2601
                                                                • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 007D2605
                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 007D260F
                                                                • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 007D2623
                                                                • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 007D2627
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                • String ID:
                                                                • API String ID: 2014098862-0
                                                                • Opcode ID: 809ca6deea9001341fabd8298789e92a55ad2ca6fecfc6752271f729064ac10e
                                                                • Instruction ID: 73190c2740902d5ab93d486a8574369f7e86306eac7df175d2c0a9a9912d4708
                                                                • Opcode Fuzzy Hash: 809ca6deea9001341fabd8298789e92a55ad2ca6fecfc6752271f729064ac10e
                                                                • Instruction Fuzzy Hash: 5A01D830390210BBFB606B689C8EF593F69EB5EB11F100106F314AF1D1C9E654458AAA
                                                                Function 007D1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,007D1449,?,?,00000000), ref: 007D180C
                                                                • HeapAlloc.KERNEL32(00000000,?,007D1449,?,?,00000000), ref: 007D1813
                                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,007D1449,?,?,00000000), ref: 007D1828
                                                                • GetCurrentProcess.KERNEL32(?,00000000,?,007D1449,?,?,00000000), ref: 007D1830
                                                                • DuplicateHandle.KERNEL32(00000000,?,007D1449,?,?,00000000), ref: 007D1833
                                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,007D1449,?,?,00000000), ref: 007D1843
                                                                • GetCurrentProcess.KERNEL32(007D1449,00000000,?,007D1449,?,?,00000000), ref: 007D184B
                                                                • DuplicateHandle.KERNEL32(00000000,?,007D1449,?,?,00000000), ref: 007D184E
                                                                • CreateThread.KERNEL32(00000000,00000000,007D1874,00000000,00000000,00000000), ref: 007D1868
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                • String ID:
                                                                • API String ID: 1957940570-0
                                                                • Opcode ID: f81218f9edcb7c66f0eb2cc5b532786f3ac23ecd330f2b7675af82f591721500
                                                                • Instruction ID: 4f61a038fdc760744ff3119441266ada13117cbf5db7da101df4d5952b3c2e50
                                                                • Opcode Fuzzy Hash: f81218f9edcb7c66f0eb2cc5b532786f3ac23ecd330f2b7675af82f591721500
                                                                • Instruction Fuzzy Hash: 1701BBB5240308BFE750AFA5DC4DF6B7BACFB89B11F418511FA05DB2A2CA749800CB20
                                                                Function 007A3E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: __alldvrm$_strrchr
                                                                • String ID: }}y$}}y$}}y
                                                                • API String ID: 1036877536-1917491473
                                                                • Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                • Instruction ID: 068a21e564a763bfb6107686cc08dc82abec53634eda17ad242182b02678879e
                                                                • Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                • Instruction Fuzzy Hash: 8AA14872E103869FDB15CF18C8917AEBBE4EFE3350F1442ADE5959B282C2BD8981C750
                                                                Function 007FA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007DD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 007DD501
                                                                  • Part of subcall function 007DD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 007DD50F
                                                                  • Part of subcall function 007DD4DC: FindCloseChangeNotification.KERNEL32(00000000), ref: 007DD5DC
                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 007FA16D
                                                                • GetLastError.KERNEL32 ref: 007FA180
                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 007FA1B3
                                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 007FA268
                                                                • GetLastError.KERNEL32(00000000), ref: 007FA273
                                                                • CloseHandle.KERNEL32(00000000), ref: 007FA2C4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
                                                                • String ID: SeDebugPrivilege
                                                                • API String ID: 1701285019-2896544425
                                                                • Opcode ID: cafb6472288cd5fb6cc501faff78e23c86ca09a6679f6c794b4e0d0165bbf129
                                                                • Instruction ID: 2d8a8aadecf7bc6c9cb7facfa51950bc30d46059712e7d6dd4deafc8d1fc55bc
                                                                • Opcode Fuzzy Hash: cafb6472288cd5fb6cc501faff78e23c86ca09a6679f6c794b4e0d0165bbf129
                                                                • Instruction Fuzzy Hash: E4618F71204246AFD710DF18C498F29BBE1BF84318F19849CE56A4B7A3C77AED45CB92
                                                                Function 00803886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00803925
                                                                • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0080393A
                                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00803954
                                                                • _wcslen.LIBCMT ref: 00803999
                                                                • SendMessageW.USER32(?,00001057,00000000,?), ref: 008039C6
                                                                • SendMessageW.USER32(?,00001061,?,0000000F), ref: 008039F4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$Window_wcslen
                                                                • String ID: SysListView32
                                                                • API String ID: 2147712094-78025650
                                                                • Opcode ID: 513571a21c126df8f73cc2e25a4c4d27a9fda8b86491df6a97a433ca538aabe0
                                                                • Instruction ID: 8ee8f4defb5f41cfe7d7cec58d7f995cb8d9b8c64d27c1e639df673491ec9cb1
                                                                • Opcode Fuzzy Hash: 513571a21c126df8f73cc2e25a4c4d27a9fda8b86491df6a97a433ca538aabe0
                                                                • Instruction Fuzzy Hash: 4041A071A00219ABEF619F64CC49FEA7BADFF08350F10052AF958E72C1D7759A80CB90
                                                                Function 007DBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007DBCFD
                                                                • IsMenu.USER32(00000000), ref: 007DBD1D
                                                                • CreatePopupMenu.USER32 ref: 007DBD53
                                                                • GetMenuItemCount.USER32(016556E0), ref: 007DBDA4
                                                                • InsertMenuItemW.USER32(016556E0,?,00000001,00000030), ref: 007DBDCC
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                • String ID: 0$2
                                                                • API String ID: 93392585-3793063076
                                                                • Opcode ID: 2842445db0e20baeee46d0d61f7ef6c995a0a1ff92a50d98bd9dd092be8b0438
                                                                • Instruction ID: 7f231cb3f2ecd7ed835c0eace1e409fa38b922eed36afa9f8e1098c977311b45
                                                                • Opcode Fuzzy Hash: 2842445db0e20baeee46d0d61f7ef6c995a0a1ff92a50d98bd9dd092be8b0438
                                                                • Instruction Fuzzy Hash: 8951AF70B00205EBDF11CFA8D888BAEBBF6BF49314F15425BE44197391D778A941CB61
                                                                Function 00792D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _ValidateLocalCookies.LIBCMT ref: 00792D4B
                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 00792D53
                                                                • _ValidateLocalCookies.LIBCMT ref: 00792DE1
                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00792E0C
                                                                • _ValidateLocalCookies.LIBCMT ref: 00792E61
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                • String ID: &Hy$csm
                                                                • API String ID: 1170836740-3238203172
                                                                • Opcode ID: d45156fdf437b89192cfc2a1b8d372bc03c0d42133c7961df6ea1b2b8dec2749
                                                                • Instruction ID: 85ce1ba64ae360ec310ff301e5e735a0f654e3f7c613be67a16c60059c7d47b9
                                                                • Opcode Fuzzy Hash: d45156fdf437b89192cfc2a1b8d372bc03c0d42133c7961df6ea1b2b8dec2749
                                                                • Instruction Fuzzy Hash: F041B534A01209FBCF14EF68D849A9EBBB5BF45324F148155E814AB393D7399E02CBD0
                                                                Function 007DC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadIconW.USER32(00000000,00007F03), ref: 007DC913
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: IconLoad
                                                                • String ID: blank$info$question$stop$warning
                                                                • API String ID: 2457776203-404129466
                                                                • Opcode ID: 231adf7b462b8b2c04bfce736aa382e752bda636aff1557ce044d0e381594dc8
                                                                • Instruction ID: cf38743cf32d7f812a00a7deb7b215f218a100a83ac5ebbc99eed7e4e868cd2a
                                                                • Opcode Fuzzy Hash: 231adf7b462b8b2c04bfce736aa382e752bda636aff1557ce044d0e381594dc8
                                                                • Instruction Fuzzy Hash: 6D11EB31689307BEEB025B54EC93CAA67BCEF15364B50412BF500E6382E77C6D0192A4
                                                                Function 007DDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                • String ID: 0.0.0.0
                                                                • API String ID: 642191829-3771769585
                                                                • Opcode ID: c24de46ad6656b0ab30530804f90ca578d9fd9cd20ecb330002281e2102d4c5f
                                                                • Instruction ID: 4e1d2b56adf0be60dee62c792e122225de842b4d522e8352024ae81340719617
                                                                • Opcode Fuzzy Hash: c24de46ad6656b0ab30530804f90ca578d9fd9cd20ecb330002281e2102d4c5f
                                                                • Instruction Fuzzy Hash: 0011E771904104EFCB306B649C0AEDE777CEB14711F04016AF44596291EF789E818B50
                                                                Function 00809F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                • GetSystemMetrics.USER32(0000000F), ref: 00809FC7
                                                                • GetSystemMetrics.USER32(0000000F), ref: 00809FE7
                                                                • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0080A224
                                                                • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0080A242
                                                                • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0080A263
                                                                • ShowWindow.USER32(00000003,00000000), ref: 0080A282
                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 0080A2A7
                                                                • DefDlgProcW.USER32(?,00000005,?,?), ref: 0080A2CA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                • String ID:
                                                                • API String ID: 1211466189-0
                                                                • Opcode ID: 8c412ea0810832b52bb312b00c323b923b16a598a28b47428eb4e58859e6e8aa
                                                                • Instruction ID: 7e88a5a20b6736788197d311ebe4fb828d40f7e04fdca72031fc65dee00edfa7
                                                                • Opcode Fuzzy Hash: 8c412ea0810832b52bb312b00c323b923b16a598a28b47428eb4e58859e6e8aa
                                                                • Instruction Fuzzy Hash: A3B18935600219EFDF58CF68C9857AE7BB2FF48701F098169EC89DB295DB31A940CB51
                                                                Function 007DED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$LocalTime
                                                                • String ID:
                                                                • API String ID: 952045576-0
                                                                • Opcode ID: 98a7de81358668e93d2f6a7c082c4ce86c3d5ef6cfd54fe463175875151b6c39
                                                                • Instruction ID: e928c34635bf35643081e2cc9b3d9fbf57e3c67ed96e0bd7074e8c82fe47fd27
                                                                • Opcode Fuzzy Hash: 98a7de81358668e93d2f6a7c082c4ce86c3d5ef6cfd54fe463175875151b6c39
                                                                • Instruction Fuzzy Hash: 88418066C10218B5DF11FBB49C8E9CFB7B8AF45710F508562E518E3222FB38E655C3A5
                                                                Function 0078F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,007C682C,00000004,00000000,00000000), ref: 0078F953
                                                                • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,007C682C,00000004,00000000,00000000), ref: 007CF3D1
                                                                • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,007C682C,00000004,00000000,00000000), ref: 007CF454
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ShowWindow
                                                                • String ID:
                                                                • API String ID: 1268545403-0
                                                                • Opcode ID: 0aa4496c799721a1e83ee6a370163fdffa3035185faf42ee15862e2d607db570
                                                                • Instruction ID: a7029f782ebec5749f6e9fc4dbeb332bcc587591009897b2bf841173df195298
                                                                • Opcode Fuzzy Hash: 0aa4496c799721a1e83ee6a370163fdffa3035185faf42ee15862e2d607db570
                                                                • Instruction Fuzzy Hash: F7411531648680FEC739AF2DC888B2A7F92BB56320F14453CE087D6660C63EB980CB11
                                                                Function 00802D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DeleteObject.GDI32(00000000), ref: 00802D1B
                                                                • GetDC.USER32(00000000), ref: 00802D23
                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00802D2E
                                                                • ReleaseDC.USER32(00000000,00000000), ref: 00802D3A
                                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00802D76
                                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00802D87
                                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00805A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00802DC2
                                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00802DE1
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                • String ID:
                                                                • API String ID: 3864802216-0
                                                                • Opcode ID: d301b8292e6e77a3146fac3ab5ad77fc42d1a5cd302a1e6e6f925b0381b9a902
                                                                • Instruction ID: ced511fd39f1fa56090cd0f400c3a80500d584e537d85659682e313431730232
                                                                • Opcode Fuzzy Hash: d301b8292e6e77a3146fac3ab5ad77fc42d1a5cd302a1e6e6f925b0381b9a902
                                                                • Instruction Fuzzy Hash: 19317872201214ABEBA18F548C8AFAB3BA9FB1A711F044155FE08DA2D1C6B59C41CBA0
                                                                Function 007D5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _memcmp
                                                                • String ID:
                                                                • API String ID: 2931989736-0
                                                                • Opcode ID: 6685076326dc5db78050ef37e39940aea8c1de181e87791e64b5d60f2e1a2f2d
                                                                • Instruction ID: 19eabeb6f2701306dde603ac5546525d5d0831e9e41086fe9aac431f20ab0c48
                                                                • Opcode Fuzzy Hash: 6685076326dc5db78050ef37e39940aea8c1de181e87791e64b5d60f2e1a2f2d
                                                                • Instruction Fuzzy Hash: 1E212C61744A19F7E61555109D87FFA337CFF20B94F944022FE149AB82F72CED2086A5
                                                                Function 007F4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: NULL Pointer assignment$Not an Object type
                                                                • API String ID: 0-572801152
                                                                • Opcode ID: 8fdd78773fd525c22e73f207052e586a68c63ae35325d5b9e3eb2308eeb3427f
                                                                • Instruction ID: 05ab46e38483b1a66026c6267c28b6bfa961768fed64c4951903288a2f15f4d4
                                                                • Opcode Fuzzy Hash: 8fdd78773fd525c22e73f207052e586a68c63ae35325d5b9e3eb2308eeb3427f
                                                                • Instruction Fuzzy Hash: BCD18071A0060EAFDB10CF68C885BBEB7B5BF48354F148169EA15AB381E774DD41CB90
                                                                Function 007B1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,007B17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 007B15CE
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,007B17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007B1651
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,007B17FB,?,007B17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007B16E4
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,007B17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007B16FB
                                                                  • Part of subcall function 007A3820: RtlAllocateHeap.NTDLL(00000000,?,00841444,?,0078FDF5,?,?,0077A976,00000010,00841440,007713FC,?,007713C6,?,00771129), ref: 007A3852
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,007B17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007B1777
                                                                • __freea.LIBCMT ref: 007B17A2
                                                                • __freea.LIBCMT ref: 007B17AE
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                                • String ID:
                                                                • API String ID: 2829977744-0
                                                                • Opcode ID: 6fa8af8e740b1f492a4343924a15f005fad49df84e2e72093805dab65eef638d
                                                                • Instruction ID: 69f360c365e9cf206217ffff0de2459804920d125fcbaf74d7edcd1e995ce034
                                                                • Opcode Fuzzy Hash: 6fa8af8e740b1f492a4343924a15f005fad49df84e2e72093805dab65eef638d
                                                                • Instruction Fuzzy Hash: 1691A271E102169ADB208F74C8A5BEEBBB5AF49310FD84669F801E7141DB2DDD40CBA0
                                                                Function 007F4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearInit
                                                                • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                • API String ID: 2610073882-625585964
                                                                • Opcode ID: dba6909cfd7445f5e5992ad63e2e5a9d21147ce676ab05494829189bdf91dbed
                                                                • Instruction ID: 9d592c23d4963a0b44bb23b3ba9e8d5f611e7c7edd2d0b05bc1238ffc61d22ad
                                                                • Opcode Fuzzy Hash: dba6909cfd7445f5e5992ad63e2e5a9d21147ce676ab05494829189bdf91dbed
                                                                • Instruction Fuzzy Hash: 90917F71A00219ABDF20DFA5C888EAFB7B8FF46714F108559F615AB380D7789945CBA0
                                                                Function 007E1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 007E125C
                                                                • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 007E1284
                                                                • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 007E12A8
                                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007E12D8
                                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007E135F
                                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007E13C4
                                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007E1430
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                                • String ID:
                                                                • API String ID: 2550207440-0
                                                                • Opcode ID: 2e234c5035646b46bd4f9b8cf47af50a82c9cbff803addcc21a214397e0677fa
                                                                • Instruction ID: c6bd373a940f096027c7dadd402e1d834061c5fd06e0ab042a953091a95ea94c
                                                                • Opcode Fuzzy Hash: 2e234c5035646b46bd4f9b8cf47af50a82c9cbff803addcc21a214397e0677fa
                                                                • Instruction Fuzzy Hash: 4591D575A01248DFDB00DFA5C88ABBE77B9FF49325F514029EA00EB291D77CA941CB90
                                                                Function 0078948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ObjectSelect$BeginCreatePath
                                                                • String ID:
                                                                • API String ID: 3225163088-0
                                                                • Opcode ID: 85167bf8c7e4050ea02feaad7c08460ca0ecb0cbf8ec0305f142d07d1a159ad8
                                                                • Instruction ID: d715b1b912f6e54f4be4b84de584e64300f4d622d8b6229bcc43210ae2645f1c
                                                                • Opcode Fuzzy Hash: 85167bf8c7e4050ea02feaad7c08460ca0ecb0cbf8ec0305f142d07d1a159ad8
                                                                • Instruction Fuzzy Hash: 46914771940209EFCB14DFA9C888AEEBBB8FF49320F188149E515B7291D778A951CB60
                                                                Function 007F3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(?), ref: 007F396B
                                                                • CharUpperBuffW.USER32(?,?), ref: 007F3A7A
                                                                • _wcslen.LIBCMT ref: 007F3A8A
                                                                • VariantClear.OLEAUT32(?), ref: 007F3C1F
                                                                  • Part of subcall function 007E0CDF: VariantInit.OLEAUT32(00000000), ref: 007E0D1F
                                                                  • Part of subcall function 007E0CDF: VariantCopy.OLEAUT32(?,?), ref: 007E0D28
                                                                  • Part of subcall function 007E0CDF: VariantClear.OLEAUT32(?), ref: 007E0D34
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                                • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                • API String ID: 4137639002-1221869570
                                                                • Opcode ID: 4a93eb20fac34d609e84ed390175d009c3eee7aefc2d0f686bcdfa74cb1be9d2
                                                                • Instruction ID: 5070b663e75e34efa2c6cf2c92deb97a56aaa6fea9ea39de77e8c61f84a10012
                                                                • Opcode Fuzzy Hash: 4a93eb20fac34d609e84ed390175d009c3eee7aefc2d0f686bcdfa74cb1be9d2
                                                                • Instruction Fuzzy Hash: 5D914674608309DFCB04EF24C49596AB7E4BF88314F14892EF9899B351DB39EE45CB92
                                                                Function 007F4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?,?,?,007D035E), ref: 007D002B
                                                                  • Part of subcall function 007D000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?,?), ref: 007D0046
                                                                  • Part of subcall function 007D000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?,?), ref: 007D0054
                                                                  • Part of subcall function 007D000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?), ref: 007D0064
                                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 007F4C51
                                                                • _wcslen.LIBCMT ref: 007F4D59
                                                                • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 007F4DCF
                                                                • CoTaskMemFree.OLE32(?), ref: 007F4DDA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                                • String ID: NULL Pointer assignment
                                                                • API String ID: 614568839-2785691316
                                                                • Opcode ID: 273756e4d3851c9d902a16d2dd72838a178b0226b446b27e5c01af34c8294f58
                                                                • Instruction ID: b52c27601bf1e5ab29cd63bfa7933af2643a37d9678c190fe284a3fcffbf0bc6
                                                                • Opcode Fuzzy Hash: 273756e4d3851c9d902a16d2dd72838a178b0226b446b27e5c01af34c8294f58
                                                                • Instruction Fuzzy Hash: 85912971D0021DEFDF14DFA4C895AEEB7B8BF48314F10816AE619A7251DB389A44CFA0
                                                                Function 008020FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenu.USER32(?), ref: 00802183
                                                                • GetMenuItemCount.USER32(00000000), ref: 008021B5
                                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 008021DD
                                                                • _wcslen.LIBCMT ref: 00802213
                                                                • GetMenuItemID.USER32(?,?), ref: 0080224D
                                                                • GetSubMenu.USER32(?,?), ref: 0080225B
                                                                  • Part of subcall function 007D3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 007D3A57
                                                                  • Part of subcall function 007D3A3D: GetCurrentThreadId.KERNEL32 ref: 007D3A5E
                                                                  • Part of subcall function 007D3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007D25B3), ref: 007D3A65
                                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 008022E3
                                                                  • Part of subcall function 007DE97B: Sleep.KERNEL32 ref: 007DE9F3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                                • String ID:
                                                                • API String ID: 4196846111-0
                                                                • Opcode ID: d3d58d84bc3bbce4f7856094603c52fa4fa37e9380a958e31f3413cb27a42872
                                                                • Instruction ID: 91269a570e1e6a7182df64729b381ed7ba1ca225f5269173c6f1ccfcb1c88167
                                                                • Opcode Fuzzy Hash: d3d58d84bc3bbce4f7856094603c52fa4fa37e9380a958e31f3413cb27a42872
                                                                • Instruction Fuzzy Hash: BA718E75A00215EFCB51EFA4CC49AAEB7F5FF48310F148459E816EB391DB78AD418B90
                                                                Function 00807E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • IsWindow.USER32(01655500), ref: 00807F37
                                                                • IsWindowEnabled.USER32(01655500), ref: 00807F43
                                                                • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0080801E
                                                                • SendMessageW.USER32(01655500,000000B0,?,?), ref: 00808051
                                                                • IsDlgButtonChecked.USER32(?,?), ref: 00808089
                                                                • GetWindowLongW.USER32(01655500,000000EC), ref: 008080AB
                                                                • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 008080C3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                • String ID:
                                                                • API String ID: 4072528602-0
                                                                • Opcode ID: dc6d5cab5054e62689e75bdc9f1d92326b41c48562ef6ac789e00c7b1d0484f6
                                                                • Instruction ID: 1e613858d115f56d9b7a624dfb558bd1681432932bdfa719baa04dbe4561b8d3
                                                                • Opcode Fuzzy Hash: dc6d5cab5054e62689e75bdc9f1d92326b41c48562ef6ac789e00c7b1d0484f6
                                                                • Instruction Fuzzy Hash: 18716C34A08249EFEFB19F54CC94FAABBB5FF1A300F144459E955D72A1CB31A885DB20
                                                                Function 007DAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetParent.USER32(?), ref: 007DAEF9
                                                                • GetKeyboardState.USER32(?), ref: 007DAF0E
                                                                • SetKeyboardState.USER32(?), ref: 007DAF6F
                                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 007DAF9D
                                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 007DAFBC
                                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 007DAFFD
                                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 007DB020
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                • String ID:
                                                                • API String ID: 87235514-0
                                                                • Opcode ID: 86bea82f8158ab96334126bbbd628e40f2832d08127db95c6f7a626ca4799dae
                                                                • Instruction ID: d3d615f5646f3a58181a263b3601e17fb85124d3da204fff067cd3897f3fd1d0
                                                                • Opcode Fuzzy Hash: 86bea82f8158ab96334126bbbd628e40f2832d08127db95c6f7a626ca4799dae
                                                                • Instruction Fuzzy Hash: 4D51D1A1A047D57DFB3643348849BBBBEB96B06304F08858AE1E9459C2C39DE9C8D761
                                                                Function 007DACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetParent.USER32(00000000), ref: 007DAD19
                                                                • GetKeyboardState.USER32(?), ref: 007DAD2E
                                                                • SetKeyboardState.USER32(?), ref: 007DAD8F
                                                                • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 007DADBB
                                                                • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 007DADD8
                                                                • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 007DAE17
                                                                • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 007DAE38
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                • String ID:
                                                                • API String ID: 87235514-0
                                                                • Opcode ID: 6ea0a97096d9690e37fb0b25023ab47916ecf79f6abcacebf1eda6c0c41c1e00
                                                                • Instruction ID: 1dba3520c28bc2f1d85baef9936855cf3c26162d572aa5f67792db7e264d4509
                                                                • Opcode Fuzzy Hash: 6ea0a97096d9690e37fb0b25023ab47916ecf79f6abcacebf1eda6c0c41c1e00
                                                                • Instruction Fuzzy Hash: 6E51D5A16047D53DFB3683348C56B7A7FB97B46300F08858AE1D556AC2D29CEC88E762
                                                                Function 007A542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetConsoleCP.KERNEL32(007B3CD6,?,?,?,?,?,?,?,?,007A5BA3,?,?,007B3CD6,?,?), ref: 007A5470
                                                                • __fassign.LIBCMT ref: 007A54EB
                                                                • __fassign.LIBCMT ref: 007A5506
                                                                • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,007B3CD6,00000005,00000000,00000000), ref: 007A552C
                                                                • WriteFile.KERNEL32(?,007B3CD6,00000000,007A5BA3,00000000,?,?,?,?,?,?,?,?,?,007A5BA3,?), ref: 007A554B
                                                                • WriteFile.KERNEL32(?,?,00000001,007A5BA3,00000000,?,?,?,?,?,?,?,?,?,007A5BA3,?), ref: 007A5584
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                • String ID:
                                                                • API String ID: 1324828854-0
                                                                • Opcode ID: e573290df054a4f6e66ca1a6cf60e85ed797e05e7dc27e1e5e71c94f40c59bcc
                                                                • Instruction ID: 300417f962804ac7350cc23edd0547b67bfc43a6d5c23cdba87e7bc0066b6bde
                                                                • Opcode Fuzzy Hash: e573290df054a4f6e66ca1a6cf60e85ed797e05e7dc27e1e5e71c94f40c59bcc
                                                                • Instruction Fuzzy Hash: 6F51D471E006499FDB10CFA8D845AEEBBFAFF4A300F14421AF955E7291E7349A51CB60
                                                                Function 007F10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007F304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 007F307A
                                                                  • Part of subcall function 007F304E: _wcslen.LIBCMT ref: 007F309B
                                                                • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 007F1112
                                                                • WSAGetLastError.WSOCK32 ref: 007F1121
                                                                • WSAGetLastError.WSOCK32 ref: 007F11C9
                                                                • closesocket.WSOCK32(00000000), ref: 007F11F9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                                • String ID:
                                                                • API String ID: 2675159561-0
                                                                • Opcode ID: e2d9949c572b3d1eaf828ae3986e8e3c4e257a59fcdff6fe28db740693d804da
                                                                • Instruction ID: 5e8b7ed999b0932709a1a9227fb069fe7e806e1666aa510c1ff8320175b22d4a
                                                                • Opcode Fuzzy Hash: e2d9949c572b3d1eaf828ae3986e8e3c4e257a59fcdff6fe28db740693d804da
                                                                • Instruction Fuzzy Hash: 7541C33160020CEFDB109F24C889BB9B7E9FF45364F548159FA199B391C778AD41CBA1
                                                                Function 007DCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007DDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007DCF22,?), ref: 007DDDFD
                                                                  • Part of subcall function 007DDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007DCF22,?), ref: 007DDE16
                                                                • lstrcmpiW.KERNEL32(?,?), ref: 007DCF45
                                                                • MoveFileW.KERNEL32(?,?), ref: 007DCF7F
                                                                • _wcslen.LIBCMT ref: 007DD005
                                                                • _wcslen.LIBCMT ref: 007DD01B
                                                                • SHFileOperationW.SHELL32(?), ref: 007DD061
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                                • String ID: \*.*
                                                                • API String ID: 3164238972-1173974218
                                                                • Opcode ID: b24a3d1c0ff01aecae7cf978e77539a1237aa2063d2b8d00d5cd573107392a0d
                                                                • Instruction ID: 36d32938a45aa50a233d0aa3e431673f06528a4e5dda2b75140867fd8415b3d6
                                                                • Opcode Fuzzy Hash: b24a3d1c0ff01aecae7cf978e77539a1237aa2063d2b8d00d5cd573107392a0d
                                                                • Instruction Fuzzy Hash: EB4137729452199FDF13EFA4D985ADDB7B9AF48380F1400E7E505EB241EB38AA44CB50
                                                                Function 00802DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00802E1C
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00802E4F
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00802E84
                                                                • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00802EB6
                                                                • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00802EE0
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00802EF1
                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00802F0B
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: LongWindow$MessageSend
                                                                • String ID:
                                                                • API String ID: 2178440468-0
                                                                • Opcode ID: ac2100d68c9ec69817ae6ed1481266e114f5afc7418855e8bbf9c50ef0344b33
                                                                • Instruction ID: 7d6d6c14581ffb861f1897fe1613fb862d46d08192ccfa0d53681f29d4b5bff5
                                                                • Opcode Fuzzy Hash: ac2100d68c9ec69817ae6ed1481266e114f5afc7418855e8bbf9c50ef0344b33
                                                                • Instruction Fuzzy Hash: 58311534685144AFDBA0CF58DC88F653BE4FB5A750F1401A4FA15CB2F2CBB1A880DB01
                                                                Function 007D7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007D7769
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007D778F
                                                                • SysAllocString.OLEAUT32(00000000), ref: 007D7792
                                                                • SysAllocString.OLEAUT32(?), ref: 007D77B0
                                                                • SysFreeString.OLEAUT32(?), ref: 007D77B9
                                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 007D77DE
                                                                • SysAllocString.OLEAUT32(?), ref: 007D77EC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                • String ID:
                                                                • API String ID: 3761583154-0
                                                                • Opcode ID: b9da604d123ad7567371fc314e60b54be36963fd5a9f01863275276b2907d727
                                                                • Instruction ID: b55136538042f380b0eba41d62d0bd76b54b0ac8588e0dbbdaa9d8776e073ad7
                                                                • Opcode Fuzzy Hash: b9da604d123ad7567371fc314e60b54be36963fd5a9f01863275276b2907d727
                                                                • Instruction Fuzzy Hash: 27219076604219AFDB14EFA8CC88CBB77ACFB097747048526FA15DB2A0E674DC41CB64
                                                                Function 007D77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007D7842
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007D7868
                                                                • SysAllocString.OLEAUT32(00000000), ref: 007D786B
                                                                • SysAllocString.OLEAUT32 ref: 007D788C
                                                                • SysFreeString.OLEAUT32 ref: 007D7895
                                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 007D78AF
                                                                • SysAllocString.OLEAUT32(?), ref: 007D78BD
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                • String ID:
                                                                • API String ID: 3761583154-0
                                                                • Opcode ID: 2382a038901ecbf44a0c5523ce7d84499f23e99893b1b639b4bde23824b41193
                                                                • Instruction ID: d551198714c6917c684359437dc3f49f30d4df07df46f6b8bb417264eb2a17dd
                                                                • Opcode Fuzzy Hash: 2382a038901ecbf44a0c5523ce7d84499f23e99893b1b639b4bde23824b41193
                                                                • Instruction Fuzzy Hash: 98215335608204AFDB14AFB8DC8DDAA77FCFB097607108126F915CB2A1E678DC41DB64
                                                                Function 007E04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetStdHandle.KERNEL32(0000000C), ref: 007E04F2
                                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007E052E
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateHandlePipe
                                                                • String ID: nul
                                                                • API String ID: 1424370930-2873401336
                                                                • Opcode ID: 035749a5596aee2949bffe7df0e9b224a46d108d5749008955b945a51289fbe8
                                                                • Instruction ID: 12a77032455488fff5d43d0538ca0e206a18495e78052d5c15f9267ce660ed40
                                                                • Opcode Fuzzy Hash: 035749a5596aee2949bffe7df0e9b224a46d108d5749008955b945a51289fbe8
                                                                • Instruction Fuzzy Hash: F7219171501345AFDB208F2ADC08E9A77B4BF49724F204A19F8A1D72E0D7B4D9A0CFA0
                                                                Function 007E05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetStdHandle.KERNEL32(000000F6), ref: 007E05C6
                                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007E0601
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateHandlePipe
                                                                • String ID: nul
                                                                • API String ID: 1424370930-2873401336
                                                                • Opcode ID: 2963c7f11b8e5c437434729c8e20941b880204d3a508f7ae63352d92885e10fc
                                                                • Instruction ID: 4fb3c7ac8066b23dc4a01d54f843d4965c11651aba374a7e50f96d8d8ccae573
                                                                • Opcode Fuzzy Hash: 2963c7f11b8e5c437434729c8e20941b880204d3a508f7ae63352d92885e10fc
                                                                • Instruction Fuzzy Hash: B72192755013459BDB209F6ADC08B9A77F4BF99720F240B19F8A1E72E0D7F498A0CB90
                                                                Function 008040AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 0077600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0077604C
                                                                  • Part of subcall function 0077600E: GetStockObject.GDI32(00000011), ref: 00776060
                                                                  • Part of subcall function 0077600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0077606A
                                                                • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00804112
                                                                • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0080411F
                                                                • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0080412A
                                                                • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00804139
                                                                • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00804145
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CreateObjectStockWindow
                                                                • String ID: Msctls_Progress32
                                                                • API String ID: 1025951953-3636473452
                                                                • Opcode ID: e49246a35a8969d4a3472fe9f658b8c6f768d8613d9576101e060d547d6b34c1
                                                                • Instruction ID: bd8d9b37358b1d25a1e6bedfef346d10950c6f5d6bf5e4ba53c068da4e5b45eb
                                                                • Opcode Fuzzy Hash: e49246a35a8969d4a3472fe9f658b8c6f768d8613d9576101e060d547d6b34c1
                                                                • Instruction Fuzzy Hash: 96118EB218021DBEEF619E64CC85EE77F6DFF18798F004110BB18E2190CA769C61DBA4
                                                                Function 007AD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007AD7A3: _free.LIBCMT ref: 007AD7CC
                                                                • _free.LIBCMT ref: 007AD82D
                                                                  • Part of subcall function 007A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000), ref: 007A29DE
                                                                  • Part of subcall function 007A29C8: GetLastError.KERNEL32(00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000,00000000), ref: 007A29F0
                                                                • _free.LIBCMT ref: 007AD838
                                                                • _free.LIBCMT ref: 007AD843
                                                                • _free.LIBCMT ref: 007AD897
                                                                • _free.LIBCMT ref: 007AD8A2
                                                                • _free.LIBCMT ref: 007AD8AD
                                                                • _free.LIBCMT ref: 007AD8B8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast
                                                                • String ID:
                                                                • API String ID: 776569668-0
                                                                • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                • Instruction ID: 02719992826948fe385c18085575b22d030f6fab895d37a595332b07766ef863
                                                                • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                • Instruction Fuzzy Hash: 09115171540B04EAD531BFB0CC4FFCB7BDC6F82700F400A25B29AA68B3DA6DB9064A51
                                                                Function 007DDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 007DDA74
                                                                • LoadStringW.USER32(00000000), ref: 007DDA7B
                                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 007DDA91
                                                                • LoadStringW.USER32(00000000), ref: 007DDA98
                                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 007DDADC
                                                                Strings
                                                                • %s (%d) : ==> %s: %s %s, xrefs: 007DDAB9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: HandleLoadModuleString$Message
                                                                • String ID: %s (%d) : ==> %s: %s %s
                                                                • API String ID: 4072794657-3128320259
                                                                • Opcode ID: 7ff13fe97245a2471109bbdf93d71f2eda4bcfcf605ee0627e59ec4c21ac8489
                                                                • Instruction ID: ba571193234c5bb2440b917cbf6c6292c4cd4f977a974b9c7bd8d012b11d297e
                                                                • Opcode Fuzzy Hash: 7ff13fe97245a2471109bbdf93d71f2eda4bcfcf605ee0627e59ec4c21ac8489
                                                                • Instruction Fuzzy Hash: 4E016DF6900208BFE750ABE4DD89EEB376CFB08301F404596B716E2181EA749E848F74
                                                                Function 007E096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InterlockedExchange.KERNEL32(0164EC88,0164EC88), ref: 007E097B
                                                                • EnterCriticalSection.KERNEL32(0164EC68,00000000), ref: 007E098D
                                                                • TerminateThread.KERNEL32(?,000001F6), ref: 007E099B
                                                                • WaitForSingleObject.KERNEL32(?,000003E8), ref: 007E09A9
                                                                • CloseHandle.KERNEL32(?), ref: 007E09B8
                                                                • InterlockedExchange.KERNEL32(0164EC88,000001F6), ref: 007E09C8
                                                                • LeaveCriticalSection.KERNEL32(0164EC68), ref: 007E09CF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                • String ID:
                                                                • API String ID: 3495660284-0
                                                                • Opcode ID: c36fb211e4e5b44a64a8310c2f8f4ebf5bd6016e0f9829765942b91a707b307e
                                                                • Instruction ID: 5f51cf2bb656bb407a6150a7b42f6437b7232a0fec0da32fd610e877a689af47
                                                                • Opcode Fuzzy Hash: c36fb211e4e5b44a64a8310c2f8f4ebf5bd6016e0f9829765942b91a707b307e
                                                                • Instruction Fuzzy Hash: 4CF0EC32542A12BBD7915FA4EE8DBD6BB39FF05702F402225F20290CB1C775A465CF90
                                                                Function 007F1C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 007F1DC0
                                                                • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 007F1DE1
                                                                • WSAGetLastError.WSOCK32 ref: 007F1DF2
                                                                • htons.WSOCK32(?,?,?,?,?), ref: 007F1EDB
                                                                • inet_ntoa.WSOCK32(?), ref: 007F1E8C
                                                                  • Part of subcall function 007D39E8: _strlen.LIBCMT ref: 007D39F2
                                                                  • Part of subcall function 007F3224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,007EEC0C), ref: 007F3240
                                                                • _strlen.LIBCMT ref: 007F1F35
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
                                                                • String ID:
                                                                • API String ID: 3203458085-0
                                                                • Opcode ID: f8a39acd8d5da1d57d17a4e51dbe06c3dd78f74f0b4fd16ec28345db3bc7773c
                                                                • Instruction ID: 77a8203cb3fcae3222b7e140acd3bb340934e496ca9debe72ce7644af610c0ea
                                                                • Opcode Fuzzy Hash: f8a39acd8d5da1d57d17a4e51dbe06c3dd78f74f0b4fd16ec28345db3bc7773c
                                                                • Instruction Fuzzy Hash: A6B1AB30204344EFC724EF24C899E2A77E5AF85318F94855CF65A5B3A2DB39ED42CB91
                                                                Function 00775D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetClientRect.USER32(?,?), ref: 00775D30
                                                                • GetWindowRect.USER32(?,?), ref: 00775D71
                                                                • ScreenToClient.USER32(?,?), ref: 00775D99
                                                                • GetClientRect.USER32(?,?), ref: 00775ED7
                                                                • GetWindowRect.USER32(?,?), ref: 00775EF8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Rect$Client$Window$Screen
                                                                • String ID:
                                                                • API String ID: 1296646539-0
                                                                • Opcode ID: 60d08f0a0765277af2723e5f5a5e2232428ee9a27382e5a3e087ad996613fe42
                                                                • Instruction ID: 4bd262ab035e0e9c193a9b83b4136b3e2b4a9ba15b1e3fa01fa1e9c15c9a5558
                                                                • Opcode Fuzzy Hash: 60d08f0a0765277af2723e5f5a5e2232428ee9a27382e5a3e087ad996613fe42
                                                                • Instruction Fuzzy Hash: 27B16735A00A4ADBDF10CFA9C4807EEB7F1FF58310F14851AE8A9D7250DB78AA51DB54
                                                                Function 007A01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __allrem.LIBCMT ref: 007A00BA
                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A00D6
                                                                • __allrem.LIBCMT ref: 007A00ED
                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A010B
                                                                • __allrem.LIBCMT ref: 007A0122
                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A0140
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                • String ID:
                                                                • API String ID: 1992179935-0
                                                                • Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
                                                                • Instruction ID: c9ae4a97023d90d9e11598753216e139716703e96f8a6f7f513c048c0da459c7
                                                                • Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
                                                                • Instruction Fuzzy Hash: 7081F776A00706DBEB249F68DC45BAF73E9AF82324F24473AF551D7681E778D9008B90
                                                                Function 007A61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,007982D9,007982D9,?,?,?,007A644F,00000001,00000001,8BE85006), ref: 007A6258
                                                                • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,007A644F,00000001,00000001,8BE85006,?,?,?), ref: 007A62DE
                                                                • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 007A63D8
                                                                • __freea.LIBCMT ref: 007A63E5
                                                                  • Part of subcall function 007A3820: RtlAllocateHeap.NTDLL(00000000,?,00841444,?,0078FDF5,?,?,0077A976,00000010,00841440,007713FC,?,007713C6,?,00771129), ref: 007A3852
                                                                • __freea.LIBCMT ref: 007A63EE
                                                                • __freea.LIBCMT ref: 007A6413
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                • String ID:
                                                                • API String ID: 1414292761-0
                                                                • Opcode ID: 176367618619b9171a9d67ee8b7ad6ee2df3ea7d1265bf08a22aa4bd054bb41a
                                                                • Instruction ID: 5d34cf38f3639ee653999e371596efb7b7e1f2d9bb28180881e4d65ee4b7d850
                                                                • Opcode Fuzzy Hash: 176367618619b9171a9d67ee8b7ad6ee2df3ea7d1265bf08a22aa4bd054bb41a
                                                                • Instruction Fuzzy Hash: 2251A172A00216EBEF258F64DC85EAF77AAEF86750F194729FD05D6180DB38DC41C6A0
                                                                Function 007FBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007FC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007FB6AE,?,?), ref: 007FC9B5
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FC9F1
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FCA68
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FCA9E
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007FBCCA
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007FBD25
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 007FBD6A
                                                                • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 007FBD99
                                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 007FBDF3
                                                                • RegCloseKey.ADVAPI32(?), ref: 007FBDFF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                • String ID:
                                                                • API String ID: 1120388591-0
                                                                • Opcode ID: 08aa23637a223224efaad6144221c8f9d23e33a23d378a0eaa50be3f7e77984e
                                                                • Instruction ID: 404891cf0069bb1e44e287fbcbb6d8723900bbfa1de59cd1a565360bca906420
                                                                • Opcode Fuzzy Hash: 08aa23637a223224efaad6144221c8f9d23e33a23d378a0eaa50be3f7e77984e
                                                                • Instruction Fuzzy Hash: EC819D30208245EFD714DF24C895E2ABBE5FF84348F14896CF6598B2A2DB35ED45CB92
                                                                Function 007CF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(00000035), ref: 007CF7B9
                                                                • SysAllocString.OLEAUT32(00000001), ref: 007CF860
                                                                • VariantCopy.OLEAUT32(007CFA64,00000000), ref: 007CF889
                                                                • VariantClear.OLEAUT32(007CFA64), ref: 007CF8AD
                                                                • VariantCopy.OLEAUT32(007CFA64,00000000), ref: 007CF8B1
                                                                • VariantClear.OLEAUT32(?), ref: 007CF8BB
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearCopy$AllocInitString
                                                                • String ID:
                                                                • API String ID: 3859894641-0
                                                                • Opcode ID: dc8e1de0378a34042fb1c1d2accfb0e6e72e528f44aef2a6d02fdb790faba046
                                                                • Instruction ID: ba2a089410a69107af2d459f705efd79bf2c84254d6feecda9b4f54cb59e2c31
                                                                • Opcode Fuzzy Hash: dc8e1de0378a34042fb1c1d2accfb0e6e72e528f44aef2a6d02fdb790faba046
                                                                • Instruction Fuzzy Hash: B2519231601310EBCF24AB65D899F29B3E6EF45710B24946FE906DF291DB789C40C7A7
                                                                Function 007E910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00777620: _wcslen.LIBCMT ref: 00777625
                                                                  • Part of subcall function 00776B57: _wcslen.LIBCMT ref: 00776B6A
                                                                • GetOpenFileNameW.COMDLG32(00000058), ref: 007E94E5
                                                                • _wcslen.LIBCMT ref: 007E9506
                                                                • _wcslen.LIBCMT ref: 007E952D
                                                                • GetSaveFileNameW.COMDLG32(00000058), ref: 007E9585
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$FileName$OpenSave
                                                                • String ID: X
                                                                • API String ID: 83654149-3081909835
                                                                • Opcode ID: 5666ee984b3a397ce1621180c53400b87c46d377819d2ac4c167c184cb97691d
                                                                • Instruction ID: 180ed4ac0e37042102b44ac71bda2d9b3609b42444c41c54e3e49a5d15091993
                                                                • Opcode Fuzzy Hash: 5666ee984b3a397ce1621180c53400b87c46d377819d2ac4c167c184cb97691d
                                                                • Instruction Fuzzy Hash: EBE1D231505340DFDB24DF25C885A6AB7E4FF89354F04896CFA899B2A2DB38DD05CB92
                                                                Function 0078920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                • BeginPaint.USER32(?,?,?), ref: 00789241
                                                                • GetWindowRect.USER32(?,?), ref: 007892A5
                                                                • ScreenToClient.USER32(?,?), ref: 007892C2
                                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 007892D3
                                                                • EndPaint.USER32(?,?,?,?,?), ref: 00789321
                                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 007C71EA
                                                                  • Part of subcall function 00789339: BeginPath.GDI32(00000000), ref: 00789357
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                                • String ID:
                                                                • API String ID: 3050599898-0
                                                                • Opcode ID: 7c29c1c05485163a5829553acb9e5498da4482fd506a64056e8ea0eababe3fd7
                                                                • Instruction ID: 26f2bf16f0176c98dec9f9fab21599ea72da241907e367d46fea0976b288b7d4
                                                                • Opcode Fuzzy Hash: 7c29c1c05485163a5829553acb9e5498da4482fd506a64056e8ea0eababe3fd7
                                                                • Instruction Fuzzy Hash: B2419170144200EFDB21EF64DC88FBA7BA8FB96320F18026DFA65871E1C7759845DB61
                                                                Function 007E07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 007E080C
                                                                • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 007E0847
                                                                • EnterCriticalSection.KERNEL32(?), ref: 007E0863
                                                                • LeaveCriticalSection.KERNEL32(?), ref: 007E08DC
                                                                • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 007E08F3
                                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 007E0921
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                • String ID:
                                                                • API String ID: 3368777196-0
                                                                • Opcode ID: 71147efae593b89da00f64fab2e217294e7dff34b5bdc98656857d2697a7b152
                                                                • Instruction ID: 7e590aac10305219d3630acc93683b76694e877a2fb1cf9044acaf79c43b5f1e
                                                                • Opcode Fuzzy Hash: 71147efae593b89da00f64fab2e217294e7dff34b5bdc98656857d2697a7b152
                                                                • Instruction Fuzzy Hash: EB418B71900205EFDF14AF64DC85AAA77B8FF48310F1440A9ED009E297DB74EEA1DBA0
                                                                Function 008081DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,007CF3AB,00000000,?,?,00000000,?,007C682C,00000004,00000000,00000000), ref: 0080824C
                                                                • EnableWindow.USER32(?,00000000), ref: 00808272
                                                                • ShowWindow.USER32(FFFFFFFF,00000000), ref: 008082D1
                                                                • ShowWindow.USER32(?,00000004), ref: 008082E5
                                                                • EnableWindow.USER32(?,00000001), ref: 0080830B
                                                                • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0080832F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Show$Enable$MessageSend
                                                                • String ID:
                                                                • API String ID: 642888154-0
                                                                • Opcode ID: 926eacac7f446af00b429e2562f866ac3ac734dcc1995191caf41922a6255316
                                                                • Instruction ID: 722aeadc51a873c9d0de98be93072591190751724db0010f2d532ee09b9407ca
                                                                • Opcode Fuzzy Hash: 926eacac7f446af00b429e2562f866ac3ac734dcc1995191caf41922a6255316
                                                                • Instruction Fuzzy Hash: AF417434601644EFDFA5CF25CC99BA47FE1FB4A714F194269E5488B2E2CB31A8C1CB51
                                                                Function 007D4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • IsWindowVisible.USER32(?), ref: 007D4C95
                                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 007D4CB2
                                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 007D4CEA
                                                                • _wcslen.LIBCMT ref: 007D4D08
                                                                • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 007D4D10
                                                                • _wcsstr.LIBVCRUNTIME ref: 007D4D1A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                                • String ID:
                                                                • API String ID: 72514467-0
                                                                • Opcode ID: 5b66ab715441113021a6ea3dc1dae3c9eed5381e7a30bb1479ddf47508aa3e77
                                                                • Instruction ID: f29dad7d0cfa0c5bb51720e9f3eb44a252e6f4bcb0bc8a86d19fc32c7b04d132
                                                                • Opcode Fuzzy Hash: 5b66ab715441113021a6ea3dc1dae3c9eed5381e7a30bb1479ddf47508aa3e77
                                                                • Instruction Fuzzy Hash: 69210732204200BBEB655B35EC49E7B7BADDF45750F10406EF909CA291EA79DC4187A0
                                                                Function 007E581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00773AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00773A97,?,?,00772E7F,?,?,?,00000000), ref: 00773AC2
                                                                • _wcslen.LIBCMT ref: 007E587B
                                                                • CoInitialize.OLE32(00000000), ref: 007E5995
                                                                • CoCreateInstance.OLE32(0080FCF8,00000000,00000001,0080FB68,?), ref: 007E59AE
                                                                • CoUninitialize.OLE32 ref: 007E59CC
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                                • String ID: .lnk
                                                                • API String ID: 3172280962-24824748
                                                                • Opcode ID: 3e4c6aa7b922fa20a524643530bb4bead67332fb2a42208f108df3ffdb3f8f5c
                                                                • Instruction ID: dd52c895922e58a8b57bc0a09d399958317205b287807adfb20a457b2a67c800
                                                                • Opcode Fuzzy Hash: 3e4c6aa7b922fa20a524643530bb4bead67332fb2a42208f108df3ffdb3f8f5c
                                                                • Instruction Fuzzy Hash: 4CD16371604605DFCB14DF25C484A2ABBE1FF89718F14895DF8899B362DB39EC05CB92
                                                                Function 007D175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007D0FCA
                                                                  • Part of subcall function 007D0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007D0FD6
                                                                  • Part of subcall function 007D0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007D0FE5
                                                                  • Part of subcall function 007D0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007D0FEC
                                                                  • Part of subcall function 007D0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007D1002
                                                                • GetLengthSid.ADVAPI32(?,00000000,007D1335), ref: 007D17AE
                                                                • GetProcessHeap.KERNEL32(00000008,00000000), ref: 007D17BA
                                                                • HeapAlloc.KERNEL32(00000000), ref: 007D17C1
                                                                • CopySid.ADVAPI32(00000000,00000000,?), ref: 007D17DA
                                                                • GetProcessHeap.KERNEL32(00000000,00000000,007D1335), ref: 007D17EE
                                                                • HeapFree.KERNEL32(00000000), ref: 007D17F5
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                                • String ID:
                                                                • API String ID: 3008561057-0
                                                                • Opcode ID: 8e30fa4058292ff87beac26d8b2bf40f8164461ce78db7f87ef756ffd8219f2a
                                                                • Instruction ID: 8216fee64d2321a73b8d7320e582243faff81785743346eb81110a1bd50b07a7
                                                                • Opcode Fuzzy Hash: 8e30fa4058292ff87beac26d8b2bf40f8164461ce78db7f87ef756ffd8219f2a
                                                                • Instruction Fuzzy Hash: 56119072601605FFDB109FA4CC49BAF7BB9FF45365F50821AF44197220D739A944CB60
                                                                Function 007D14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007D14FF
                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 007D1506
                                                                • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 007D1515
                                                                • CloseHandle.KERNEL32(00000004), ref: 007D1520
                                                                • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007D154F
                                                                • DestroyEnvironmentBlock.USERENV(00000000), ref: 007D1563
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                • String ID:
                                                                • API String ID: 1413079979-0
                                                                • Opcode ID: b4daa9596abf9807fc82cd77fecb66e03f03b4f8584a1e9a884743f1fd25d78d
                                                                • Instruction ID: 35f1a4b960a736a6dce157d45c5ff8e32878091b448a54f6482036f9cf62ee4a
                                                                • Opcode Fuzzy Hash: b4daa9596abf9807fc82cd77fecb66e03f03b4f8584a1e9a884743f1fd25d78d
                                                                • Instruction Fuzzy Hash: FB112972500249BBDF118F98ED49BDE7BB9FF48744F048115FA05A21A0C3798E60DB60
                                                                Function 00793382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLastError.KERNEL32(?,?,00793379,00792FE5), ref: 00793390
                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0079339E
                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007933B7
                                                                • SetLastError.KERNEL32(00000000,?,00793379,00792FE5), ref: 00793409
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLastValue___vcrt_
                                                                • String ID:
                                                                • API String ID: 3852720340-0
                                                                • Opcode ID: aee2dd2246045401895fac94b7eee698fdfd33a833b92ca27bce3739fa2cd7c1
                                                                • Instruction ID: 7ddd15da9a505170ec9fd51667538ab2a94b2bef57ae35c8e2f58ca1ca3d59a4
                                                                • Opcode Fuzzy Hash: aee2dd2246045401895fac94b7eee698fdfd33a833b92ca27bce3739fa2cd7c1
                                                                • Instruction Fuzzy Hash: FD01423320D711FFEF2827B4BC8AA273AA4FB453793200329F810942F0EF194E025244
                                                                Function 007A2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLastError.KERNEL32(?,?,007A5686,007B3CD6,?,00000000,?,007A5B6A,?,?,?,?,?,0079E6D1,?,00838A48), ref: 007A2D78
                                                                • _free.LIBCMT ref: 007A2DAB
                                                                • _free.LIBCMT ref: 007A2DD3
                                                                • SetLastError.KERNEL32(00000000,?,?,?,?,0079E6D1,?,00838A48,00000010,00774F4A,?,?,00000000,007B3CD6), ref: 007A2DE0
                                                                • SetLastError.KERNEL32(00000000,?,?,?,?,0079E6D1,?,00838A48,00000010,00774F4A,?,?,00000000,007B3CD6), ref: 007A2DEC
                                                                • _abort.LIBCMT ref: 007A2DF2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$_free$_abort
                                                                • String ID:
                                                                • API String ID: 3160817290-0
                                                                • Opcode ID: 4c54807185fd91b9d966dda554eaba078010055b66e1ed5d38db4874c7aabdfe
                                                                • Instruction ID: 96efebe1fc3f178a54dd85c4802ba8ccdd2e483d2e711e889ae23912be0ede1f
                                                                • Opcode Fuzzy Hash: 4c54807185fd91b9d966dda554eaba078010055b66e1ed5d38db4874c7aabdfe
                                                                • Instruction Fuzzy Hash: EEF04435745600BBC6622B3DBC0EB5F265ABFC37A5B254718F824A22E7EE2C98035561
                                                                Function 00808A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00789693
                                                                  • Part of subcall function 00789639: SelectObject.GDI32(?,00000000), ref: 007896A2
                                                                  • Part of subcall function 00789639: BeginPath.GDI32(?), ref: 007896B9
                                                                  • Part of subcall function 00789639: SelectObject.GDI32(?,00000000), ref: 007896E2
                                                                • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00808A4E
                                                                • LineTo.GDI32(?,00000003,00000000), ref: 00808A62
                                                                • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00808A70
                                                                • LineTo.GDI32(?,00000000,00000003), ref: 00808A80
                                                                • EndPath.GDI32(?), ref: 00808A90
                                                                • StrokePath.GDI32(?), ref: 00808AA0
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                • String ID:
                                                                • API String ID: 43455801-0
                                                                • Opcode ID: 83d2f03fae16fdd0ebad1ff2a20d9e3bc20ddd3c8392b1aa5c17f5b3a207ec8d
                                                                • Instruction ID: 63c2c519418fcacb00b687d9aa2e14896b173125ac9b0b5f0ff1e01f8f0b142e
                                                                • Opcode Fuzzy Hash: 83d2f03fae16fdd0ebad1ff2a20d9e3bc20ddd3c8392b1aa5c17f5b3a207ec8d
                                                                • Instruction Fuzzy Hash: 85110576000118FFEF129F90DC88EAA7F6CFB09390F048122FA199A1A1C7719D95DBA0
                                                                Function 007D51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDC.USER32(00000000), ref: 007D5218
                                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 007D5229
                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 007D5230
                                                                • ReleaseDC.USER32(00000000,00000000), ref: 007D5238
                                                                • MulDiv.KERNEL32(000009EC,?,00000000), ref: 007D524F
                                                                • MulDiv.KERNEL32(000009EC,00000001,?), ref: 007D5261
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CapsDevice$Release
                                                                • String ID:
                                                                • API String ID: 1035833867-0
                                                                • Opcode ID: 00fc89b46abee76f393d73428452de7dff3b46b859ebbe2b7d54f28046e71dc0
                                                                • Instruction ID: 9794c3cd7df37b18cafc1dc1580ef628998e73d8ab012fa4cf5d873191ad2f54
                                                                • Opcode Fuzzy Hash: 00fc89b46abee76f393d73428452de7dff3b46b859ebbe2b7d54f28046e71dc0
                                                                • Instruction Fuzzy Hash: 24014FB5A00718BBEB109FA69C49F5EBFB8FF58751F04416AFA04A7281D6709804CBA0
                                                                Function 00771BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00771BF4
                                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 00771BFC
                                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00771C07
                                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00771C12
                                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 00771C1A
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00771C22
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Virtual
                                                                • String ID:
                                                                • API String ID: 4278518827-0
                                                                • Opcode ID: 597c9caf08662a6c1664f95c8440f9792825b5caab155ce74429315b07285ef1
                                                                • Instruction ID: a64ba736f5512c3ea5d4519b7c0216c2b7f1f0ec2945d27c873b399aa32ccac5
                                                                • Opcode Fuzzy Hash: 597c9caf08662a6c1664f95c8440f9792825b5caab155ce74429315b07285ef1
                                                                • Instruction Fuzzy Hash: E8016CB09027597DE3008F5A8C85B52FFA8FF19354F00411B915C47941C7F5A864CBE5
                                                                Function 007DEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007DEB30
                                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 007DEB46
                                                                • GetWindowThreadProcessId.USER32(?,?), ref: 007DEB55
                                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007DEB64
                                                                • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007DEB6E
                                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007DEB75
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                • String ID:
                                                                • API String ID: 839392675-0
                                                                • Opcode ID: c99d7120a758e0b7b167e11877910e5416fac8d3c5c78ee6ab666698e01abc56
                                                                • Instruction ID: 3156514a7fe21a42e1926eaf197d323ef0637b174ce669e6bac8f5d993eec8b8
                                                                • Opcode Fuzzy Hash: c99d7120a758e0b7b167e11877910e5416fac8d3c5c78ee6ab666698e01abc56
                                                                • Instruction Fuzzy Hash: 8BF09AB2200118BBE7615F629C0EEEF3A7CFFCAB11F000259F611D1190D7A11A01CAB4
                                                                Function 007C7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetClientRect.USER32(?), ref: 007C7452
                                                                • SendMessageW.USER32(?,00001328,00000000,?), ref: 007C7469
                                                                • GetWindowDC.USER32(?), ref: 007C7475
                                                                • GetPixel.GDI32(00000000,?,?), ref: 007C7484
                                                                • ReleaseDC.USER32(?,00000000), ref: 007C7496
                                                                • GetSysColor.USER32(00000005), ref: 007C74B0
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                                • String ID:
                                                                • API String ID: 272304278-0
                                                                • Opcode ID: 1a75cd415889bf9367babf61af8797693a6b2cc98fc623436cacac9331e7cc13
                                                                • Instruction ID: ad18c871a6db1eea7a341f0b84c1f94c406a05ab21954c30f9d44206fe58f093
                                                                • Opcode Fuzzy Hash: 1a75cd415889bf9367babf61af8797693a6b2cc98fc623436cacac9331e7cc13
                                                                • Instruction Fuzzy Hash: 7C014B32400615EFDBA55FA4DC09FAA7BB5FB04321F550268FE25A21A1CF351E51EF50
                                                                Function 007D1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 007D187F
                                                                • UnloadUserProfile.USERENV(?,?), ref: 007D188B
                                                                • CloseHandle.KERNEL32(?), ref: 007D1894
                                                                • CloseHandle.KERNEL32(?), ref: 007D189C
                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 007D18A5
                                                                • HeapFree.KERNEL32(00000000), ref: 007D18AC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                • String ID:
                                                                • API String ID: 146765662-0
                                                                • Opcode ID: d64ff9619ef108e377b894d90866d2802148d8c13358eb3ba45b5488ba7ab183
                                                                • Instruction ID: 4abff9b4fec3a941e952bdc5688e400b714a7a0c7ec15bb52a36c8c0f1217826
                                                                • Opcode Fuzzy Hash: d64ff9619ef108e377b894d90866d2802148d8c13358eb3ba45b5488ba7ab183
                                                                • Instruction Fuzzy Hash: A3E0E536104101BBDB415FA5ED0C90AFF39FF49B22B108320F225811B0CB329420DF90
                                                                Function 007F7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00790242: EnterCriticalSection.KERNEL32(0084070C,00841884,?,?,0078198B,00842518,?,?,?,007712F9,00000000), ref: 0079024D
                                                                  • Part of subcall function 00790242: LeaveCriticalSection.KERNEL32(0084070C,?,0078198B,00842518,?,?,?,007712F9,00000000), ref: 0079028A
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007900A3: __onexit.LIBCMT ref: 007900A9
                                                                • __Init_thread_footer.LIBCMT ref: 007F7BFB
                                                                  • Part of subcall function 007901F8: EnterCriticalSection.KERNEL32(0084070C,?,?,00788747,00842514), ref: 00790202
                                                                  • Part of subcall function 007901F8: LeaveCriticalSection.KERNEL32(0084070C,?,00788747,00842514), ref: 00790235
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                                • String ID: +T|$5$G$Variable must be of type 'Object'.
                                                                • API String ID: 535116098-3335344960
                                                                • Opcode ID: 7eabed51686f1b65b15d51d659eef93f8b1707873780ba708703c4987cdd1a8a
                                                                • Instruction ID: 0ca0ddfc89f94571d24228b12794aa4b00f429adff306341417d7a92c0f77c4c
                                                                • Opcode Fuzzy Hash: 7eabed51686f1b65b15d51d659eef93f8b1707873780ba708703c4987cdd1a8a
                                                                • Instruction Fuzzy Hash: 9C918970A04209EFCB08EF94D8959BDB7B5FF49300F508059FA169B392DB39AE41CB61
                                                                Function 007DC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00777620: _wcslen.LIBCMT ref: 00777625
                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 007DC6EE
                                                                • _wcslen.LIBCMT ref: 007DC735
                                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 007DC79C
                                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 007DC7CA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ItemMenu$Info_wcslen$Default
                                                                • String ID: 0
                                                                • API String ID: 1227352736-4108050209
                                                                • Opcode ID: 1cca3fc8216ad36ab5513879739a2c86072f209842c24dbd82c9ff09defe9d8a
                                                                • Instruction ID: c0f48a5671b43101aaa167c5036b4218f6e9b55d0108fb77d6d7c19aaf467993
                                                                • Opcode Fuzzy Hash: 1cca3fc8216ad36ab5513879739a2c86072f209842c24dbd82c9ff09defe9d8a
                                                                • Instruction Fuzzy Hash: FD51C1716143029BDB169F28C889B6B7BF8EF45324F040A2AF995D33D0DB78D944DB52
                                                                Function 007D719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 007D7206
                                                                • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 007D723C
                                                                • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 007D724D
                                                                • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007D72CF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$AddressCreateInstanceProc
                                                                • String ID: DllGetClassObject
                                                                • API String ID: 753597075-1075368562
                                                                • Opcode ID: 6ee95752edcdee589797a6881c19e6ea5b075ed264f0b9ef7cbfccdde651330d
                                                                • Instruction ID: 62b65cc0759d927a7d773f914decee79051afe814485f3cace2a1fc8acc6bc66
                                                                • Opcode Fuzzy Hash: 6ee95752edcdee589797a6881c19e6ea5b075ed264f0b9ef7cbfccdde651330d
                                                                • Instruction Fuzzy Hash: B0415071604204EFDB19CF54C884A9A7BB9FF44320F1480AEBD059F34AE7B9E945DBA0
                                                                Function 00803D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00803E35
                                                                • IsMenu.USER32(?), ref: 00803E4A
                                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00803E92
                                                                • DrawMenuBar.USER32 ref: 00803EA5
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$Item$DrawInfoInsert
                                                                • String ID: 0
                                                                • API String ID: 3076010158-4108050209
                                                                • Opcode ID: 689cb3cc6c264c3a6a0905da2e9367bd17cee1acb188abffda1ef8e04ecce0d8
                                                                • Instruction ID: b663ce8748a81838dcf64989ae9ba262d1905129151a767cd66a8452ddd8bac5
                                                                • Opcode Fuzzy Hash: 689cb3cc6c264c3a6a0905da2e9367bd17cee1acb188abffda1ef8e04ecce0d8
                                                                • Instruction Fuzzy Hash: 22413779A01209EFEF50DF50DC84AAABBB9FF49354F044229E905E7690D730AE55CF60
                                                                Function 007D1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 007D3CCA
                                                                • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 007D1E66
                                                                • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 007D1E79
                                                                • SendMessageW.USER32(?,00000189,?,00000000), ref: 007D1EA9
                                                                  • Part of subcall function 00776B57: _wcslen.LIBCMT ref: 00776B6A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$_wcslen$ClassName
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 2081771294-1403004172
                                                                • Opcode ID: 5e4fb9329c6250d176fa333600b6aac44dd92b7a5b74898b34c1498fdaf2cd1b
                                                                • Instruction ID: eef8cc84ad2eb84c54a5ee5deef6efaf4ec8bc30c530cde91142dd7008209121
                                                                • Opcode Fuzzy Hash: 5e4fb9329c6250d176fa333600b6aac44dd92b7a5b74898b34c1498fdaf2cd1b
                                                                • Instruction Fuzzy Hash: CC212971A01104FEDF14AB64DC4ACFFB7B9EF56390B54411AF825A72E1DB3C4D068620
                                                                Function 00802F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00802F8D
                                                                • LoadLibraryW.KERNEL32(?), ref: 00802F94
                                                                • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00802FA9
                                                                • DestroyWindow.USER32(?), ref: 00802FB1
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                • String ID: SysAnimate32
                                                                • API String ID: 3529120543-1011021900
                                                                • Opcode ID: 210902bf59c907744e7f294da996048ffb87e59037252a82995af2639e35484c
                                                                • Instruction ID: 49ef316d1c9ff45377b5b370afec50379dac8d225b30f5cfa8c49870ab6fd68b
                                                                • Opcode Fuzzy Hash: 210902bf59c907744e7f294da996048ffb87e59037252a82995af2639e35484c
                                                                • Instruction Fuzzy Hash: D021AE7220020AABEF615F64DC88EBB77BDFB593A4F104218F950D21D0DBB1DC519760
                                                                Function 00794D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00794D1E,007A28E9,?,00794CBE,007A28E9,008388B8,0000000C,00794E15,007A28E9,00000002), ref: 00794D8D
                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00794DA0
                                                                • FreeLibrary.KERNEL32(00000000,?,?,?,00794D1E,007A28E9,?,00794CBE,007A28E9,008388B8,0000000C,00794E15,007A28E9,00000002,00000000), ref: 00794DC3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                • String ID: CorExitProcess$mscoree.dll
                                                                • API String ID: 4061214504-1276376045
                                                                • Opcode ID: a7e7619a3b48e5e040eacfb429b7953d1efb48a235e03f5cf63a25cf635e1504
                                                                • Instruction ID: 3f18138b3d98369c65e0c432e76d903418205c6acf466a9af928a60c1871e2ae
                                                                • Opcode Fuzzy Hash: a7e7619a3b48e5e040eacfb429b7953d1efb48a235e03f5cf63a25cf635e1504
                                                                • Instruction Fuzzy Hash: 3EF04F34A41208BBDB519F90EC49BEDBBB9FF44752F0441A4F909A22A0DB795981CBD0
                                                                Function 00774E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00774EDD,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774E9C
                                                                • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00774EAE
                                                                • FreeLibrary.KERNEL32(00000000,?,?,00774EDD,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774EC0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Library$AddressFreeLoadProc
                                                                • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                • API String ID: 145871493-3689287502
                                                                • Opcode ID: 2ff981b08b2ea3d52181a78ccb08b2af6bfabac63e666112cd001008acc4434f
                                                                • Instruction ID: 40b888d46b0f54fa3787699410116bb85744b4737c20e7b7572991c96a502222
                                                                • Opcode Fuzzy Hash: 2ff981b08b2ea3d52181a78ccb08b2af6bfabac63e666112cd001008acc4434f
                                                                • Instruction Fuzzy Hash: D8E08C36A026226BD7B21F25AC18A6B7658FF82BB2B054215FC08E2240DBA8CD0180E0
                                                                Function 00774E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?,007B3CDE,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774E62
                                                                • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00774E74
                                                                • FreeLibrary.KERNEL32(00000000,?,?,007B3CDE,?,00841418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00774E87
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Library$AddressFreeLoadProc
                                                                • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                • API String ID: 145871493-1355242751
                                                                • Opcode ID: 9c16458add82b446c08ca0aa77c12f081f21f492eb7e531d32adec263db76760
                                                                • Instruction ID: 1d52a11079913a58d968c3356d326e5ecccc5e0b29387946ee90e4e555f3d555
                                                                • Opcode Fuzzy Hash: 9c16458add82b446c08ca0aa77c12f081f21f492eb7e531d32adec263db76760
                                                                • Instruction Fuzzy Hash: 13D0123650266157DBA21F256C18D8B7A1CFF86BB13054725B919E2254CFA8CD0186D0
                                                                Function 007E2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007E2C05
                                                                • DeleteFileW.KERNEL32(?), ref: 007E2C87
                                                                • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 007E2C9D
                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007E2CAE
                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007E2CC0
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: File$Delete$Copy
                                                                • String ID:
                                                                • API String ID: 3226157194-0
                                                                • Opcode ID: 180f2d66ae9c558fe4b190697ef29629d1fd40ea566affe97cdee5deb020e83a
                                                                • Instruction ID: 6fe3edda001dd157bdb6c2ed2d470487a4c136b2a98578ddfcf5a8513eff55da
                                                                • Opcode Fuzzy Hash: 180f2d66ae9c558fe4b190697ef29629d1fd40ea566affe97cdee5deb020e83a
                                                                • Instruction Fuzzy Hash: 78B17FB1901119EBDF21EFA5CC89EDEB77DEF48340F1040A6F609E6152EA389A45CF61
                                                                Function 007FA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentProcessId.KERNEL32 ref: 007FA427
                                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007FA435
                                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 007FA468
                                                                • CloseHandle.KERNEL32(?), ref: 007FA63D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$CloseCountersCurrentHandleOpen
                                                                • String ID:
                                                                • API String ID: 3488606520-0
                                                                • Opcode ID: 20050eeb33f8c6145f5475971b9badab15f041b508ead40ca36ba8c623f03657
                                                                • Instruction ID: ae19be6610a02564364421f06f2ac2e68f96504009372b18b2fc694c20f19843
                                                                • Opcode Fuzzy Hash: 20050eeb33f8c6145f5475971b9badab15f041b508ead40ca36ba8c623f03657
                                                                • Instruction Fuzzy Hash: 3FA18FB1604301AFD720DF24C886F2AB7E5AF88714F14885DFA5E9B392D774EC418B92
                                                                Function 007ABB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00813700), ref: 007ABB91
                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,0084121C,000000FF,00000000,0000003F,00000000,?,?), ref: 007ABC09
                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00841270,000000FF,?,0000003F,00000000,?), ref: 007ABC36
                                                                • _free.LIBCMT ref: 007ABB7F
                                                                  • Part of subcall function 007A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000), ref: 007A29DE
                                                                  • Part of subcall function 007A29C8: GetLastError.KERNEL32(00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000,00000000), ref: 007A29F0
                                                                • _free.LIBCMT ref: 007ABD4B
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                                • String ID:
                                                                • API String ID: 1286116820-0
                                                                • Opcode ID: 5849a1d7d405e9d48b8104a3ce2746f38543f65e4f79014ba1125d9ea68e3f33
                                                                • Instruction ID: 059bd33608ad83e2cf8c926a6767a7988d97c656d3f2e1c7234262b03362e57a
                                                                • Opcode Fuzzy Hash: 5849a1d7d405e9d48b8104a3ce2746f38543f65e4f79014ba1125d9ea68e3f33
                                                                • Instruction Fuzzy Hash: 6151DA71900219DFCB10DF659C859AEB7B8FFC6320B10476AE554D7292EB745D81CB60
                                                                Function 007DE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007DDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007DCF22,?), ref: 007DDDFD
                                                                  • Part of subcall function 007DDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007DCF22,?), ref: 007DDE16
                                                                  • Part of subcall function 007DE199: GetFileAttributesW.KERNEL32(?,007DCF95), ref: 007DE19A
                                                                • lstrcmpiW.KERNEL32(?,?), ref: 007DE473
                                                                • MoveFileW.KERNEL32(?,?), ref: 007DE4AC
                                                                • _wcslen.LIBCMT ref: 007DE5EB
                                                                • _wcslen.LIBCMT ref: 007DE603
                                                                • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 007DE650
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                                • String ID:
                                                                • API String ID: 3183298772-0
                                                                • Opcode ID: 6322836d3a50dc576ecdcb008192ef7802ddc0f691902f9e048c08ade05378a8
                                                                • Instruction ID: 9377908495cf04251c7d5de0e2f04c03f2e2eb88c8affae56791ce24b8fdfb55
                                                                • Opcode Fuzzy Hash: 6322836d3a50dc576ecdcb008192ef7802ddc0f691902f9e048c08ade05378a8
                                                                • Instruction Fuzzy Hash: 6451A6B24087859BCB25EB94DC859DF73ECAF84340F00491FF689D7251EF38A5888766
                                                                Function 007FB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007FC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007FB6AE,?,?), ref: 007FC9B5
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FC9F1
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FCA68
                                                                  • Part of subcall function 007FC998: _wcslen.LIBCMT ref: 007FCA9E
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007FBAA5
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007FBB00
                                                                • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 007FBB63
                                                                • RegCloseKey.ADVAPI32(?,?), ref: 007FBBA6
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 007FBBB3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                                • String ID:
                                                                • API String ID: 826366716-0
                                                                • Opcode ID: 92e767e98979006c10327195f5062dfbd4fbf58d8b1b33522e6ba53345f805f8
                                                                • Instruction ID: 1183dd23a27f44f442aca19b203e2c05d21b4f505b8b012e86e1d5fcb157dbdc
                                                                • Opcode Fuzzy Hash: 92e767e98979006c10327195f5062dfbd4fbf58d8b1b33522e6ba53345f805f8
                                                                • Instruction Fuzzy Hash: C2619C71208205EFD714DF24C894E2ABBE5FF84348F14899CF5998B2A2CB35ED45CB92
                                                                Function 007D8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(?), ref: 007D8BCD
                                                                • VariantClear.OLEAUT32 ref: 007D8C3E
                                                                • VariantClear.OLEAUT32 ref: 007D8C9D
                                                                • VariantClear.OLEAUT32(?), ref: 007D8D10
                                                                • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 007D8D3B
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$Clear$ChangeInitType
                                                                • String ID:
                                                                • API String ID: 4136290138-0
                                                                • Opcode ID: 6c024914d536ea22b77a9476ccce67a7054d740714e14cfbc5c8efddb69c1208
                                                                • Instruction ID: 3c81f42070c33a11dffe9c836f65603900f5068b8b52b2ac7ade25be92493aa7
                                                                • Opcode Fuzzy Hash: 6c024914d536ea22b77a9476ccce67a7054d740714e14cfbc5c8efddb69c1208
                                                                • Instruction Fuzzy Hash: 49516CB5A00619EFCB14CF68C884AAAB7F5FF8D310B15855AE919DB350E734E911CFA0
                                                                Function 007E8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007E8BAE
                                                                • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 007E8BDA
                                                                • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 007E8C32
                                                                • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 007E8C57
                                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 007E8C5F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: PrivateProfile$SectionWrite$String
                                                                • String ID:
                                                                • API String ID: 2832842796-0
                                                                • Opcode ID: f366d593f85464d88c229d5685a6e62c70636e7da516571ff4c42013d4d36b7a
                                                                • Instruction ID: 43784e5fbb8c9c344317ebcf1729be3b1fe59e0de77f7e516e1f94d508499c92
                                                                • Opcode Fuzzy Hash: f366d593f85464d88c229d5685a6e62c70636e7da516571ff4c42013d4d36b7a
                                                                • Instruction Fuzzy Hash: 6C515835A00214DFCB05DF65C885A69BBF1FF49354F18C498E809AB362CB39ED51CBA1
                                                                Function 007F8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryW.KERNEL32(?,00000000,?), ref: 007F8F40
                                                                • GetProcAddress.KERNEL32(00000000,?), ref: 007F8FD0
                                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 007F8FEC
                                                                • GetProcAddress.KERNEL32(00000000,?), ref: 007F9032
                                                                • FreeLibrary.KERNEL32(00000000), ref: 007F9052
                                                                  • Part of subcall function 0078F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,007E1043,?,7529E610), ref: 0078F6E6
                                                                  • Part of subcall function 0078F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,007CFA64,00000000,00000000,?,?,007E1043,?,7529E610,?,007CFA64), ref: 0078F70D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                                • String ID:
                                                                • API String ID: 666041331-0
                                                                • Opcode ID: 5d34905bde46d72be1f9d3007c22473fa67f6c5555cb77bdbbd9bda6250d7808
                                                                • Instruction ID: d64c5551d48ff24fcafdf0adfd37585a2d9b55a84cc319d94f4c1520d2e595ee
                                                                • Opcode Fuzzy Hash: 5d34905bde46d72be1f9d3007c22473fa67f6c5555cb77bdbbd9bda6250d7808
                                                                • Instruction Fuzzy Hash: 6C515A34601209DFCB15DF58C4849ADBBF1FF49314F0881A8EA0AAB362DB35ED85CB91
                                                                Function 00806B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00806C33
                                                                • SetWindowLongW.USER32(?,000000EC,?), ref: 00806C4A
                                                                • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00806C73
                                                                • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,007EAB79,00000000,00000000), ref: 00806C98
                                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00806CC7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Long$MessageSendShow
                                                                • String ID:
                                                                • API String ID: 3688381893-0
                                                                • Opcode ID: 7efe794f7d9ff5d7cd771c0599bd80367c14cde3d86e6e23b86f01131b5dc394
                                                                • Instruction ID: 8317c44e55974c26a52c7bd2f908e9f1a8e8499844aeea3b9971cddb2c036193
                                                                • Opcode Fuzzy Hash: 7efe794f7d9ff5d7cd771c0599bd80367c14cde3d86e6e23b86f01131b5dc394
                                                                • Instruction Fuzzy Hash: B241D735A04104AFEBA4CF28CC58FA57FA5FB09364F140228F895E72E0E771AD71CA40
                                                                Function 007A2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free
                                                                • String ID:
                                                                • API String ID: 269201875-0
                                                                • Opcode ID: 7af6dfb027e1e5c1b718f2a60c21cc5621d0113a3fa1de673ee64b0e27db2c15
                                                                • Instruction ID: 087a731b5b95f0bb436634307821a4dfa6d9c6f9e1b21896602173cff3a79bb1
                                                                • Opcode Fuzzy Hash: 7af6dfb027e1e5c1b718f2a60c21cc5621d0113a3fa1de673ee64b0e27db2c15
                                                                • Instruction Fuzzy Hash: A441E272A00204DFCB24DF7CC884A5EB7E5EFCA314F1546A9E515EB352DA35AD02CB81
                                                                Function 0078912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCursorPos.USER32(?), ref: 00789141
                                                                • ScreenToClient.USER32(00000000,?), ref: 0078915E
                                                                • GetAsyncKeyState.USER32(00000001), ref: 00789183
                                                                • GetAsyncKeyState.USER32(00000002), ref: 0078919D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AsyncState$ClientCursorScreen
                                                                • String ID:
                                                                • API String ID: 4210589936-0
                                                                • Opcode ID: d54b8f9976e0dbe173dfdb39a5a80971e4e9695f01da10b73c48925bb9ccb833
                                                                • Instruction ID: e27dbe62dcea86c90faed0b25ca1cd100f9f2b3ef674ac0a14cc91a52b398830
                                                                • Opcode Fuzzy Hash: d54b8f9976e0dbe173dfdb39a5a80971e4e9695f01da10b73c48925bb9ccb833
                                                                • Instruction Fuzzy Hash: 0F415F31A0850AFBDF19AF68C848BFEB775FB45324F248219E525A72D0CB785950CF51
                                                                Function 007E3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetInputState.USER32 ref: 007E38CB
                                                                • TranslateAcceleratorW.USER32(?,00000000,?), ref: 007E3922
                                                                • TranslateMessage.USER32(?), ref: 007E394B
                                                                • DispatchMessageW.USER32(?), ref: 007E3955
                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007E3966
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                • String ID:
                                                                • API String ID: 2256411358-0
                                                                • Opcode ID: 9e61786be2f0897d81a10894c13d0692c18a7ed019c75deaca2522e799621f1a
                                                                • Instruction ID: f57492fb8e17b5d75de84101130227e603297f0ebc10e20e6a2f164d54c46840
                                                                • Opcode Fuzzy Hash: 9e61786be2f0897d81a10894c13d0692c18a7ed019c75deaca2522e799621f1a
                                                                • Instruction Fuzzy Hash: 3C31A8745063C59EEF35CB36984DBB677A8BB1A308F040569E466C3191D3BCB684CB21
                                                                Function 007ECF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 007ECF38
                                                                • InternetReadFile.WININET(?,00000000,?,?), ref: 007ECF6F
                                                                • GetLastError.KERNEL32(?,00000000,?,?,?,007EC21E,00000000), ref: 007ECFB4
                                                                • SetEvent.KERNEL32(?,?,00000000,?,?,?,007EC21E,00000000), ref: 007ECFC8
                                                                • SetEvent.KERNEL32(?,?,00000000,?,?,?,007EC21E,00000000), ref: 007ECFF2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                                • String ID:
                                                                • API String ID: 3191363074-0
                                                                • Opcode ID: 4249b3f37a89526f0976537fe1045d83fb3c894c9867731af989a8b144182366
                                                                • Instruction ID: 941ac1a97fb9d939daf41e190f06700f580180a33ed2e9f440175cd046d91981
                                                                • Opcode Fuzzy Hash: 4249b3f37a89526f0976537fe1045d83fb3c894c9867731af989a8b144182366
                                                                • Instruction Fuzzy Hash: 48315E76601245EFDB21DFA6C884AABBBF9FF18351B10442EF506D2140DB38EE42DB60
                                                                Function 007D1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowRect.USER32(?,?), ref: 007D1915
                                                                • PostMessageW.USER32(00000001,00000201,00000001), ref: 007D19C1
                                                                • Sleep.KERNEL32(00000000,?,?,?), ref: 007D19C9
                                                                • PostMessageW.USER32(00000001,00000202,00000000), ref: 007D19DA
                                                                • Sleep.KERNEL32(00000000,?,?,?,?), ref: 007D19E2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessagePostSleep$RectWindow
                                                                • String ID:
                                                                • API String ID: 3382505437-0
                                                                • Opcode ID: 4434686aaca3ee97f4d3da1b8bede35b64063bc416ea7249c35dd597ecde3aae
                                                                • Instruction ID: ab2cc56cccd9ab05a5f5dcc8aaa117eb5d536f5ebdc614bdb7300cd72c080e74
                                                                • Opcode Fuzzy Hash: 4434686aaca3ee97f4d3da1b8bede35b64063bc416ea7249c35dd597ecde3aae
                                                                • Instruction Fuzzy Hash: 3C31AD71A00259EFCB10CFA8C9A9ADE3BB5FB04315F10432AF961A72D1C774A944CB90
                                                                Function 00805706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00805745
                                                                • SendMessageW.USER32(?,00001074,?,00000001), ref: 0080579D
                                                                • _wcslen.LIBCMT ref: 008057AF
                                                                • _wcslen.LIBCMT ref: 008057BA
                                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00805816
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$_wcslen
                                                                • String ID:
                                                                • API String ID: 763830540-0
                                                                • Opcode ID: 48864edf65210128b16e075fc768571b49799f6ca2027bba1ea925dd9e95e168
                                                                • Instruction ID: 0e50bc16f76ab970cb655c912f118d02a810fc4b31d4578dc4a5496ab83be87b
                                                                • Opcode Fuzzy Hash: 48864edf65210128b16e075fc768571b49799f6ca2027bba1ea925dd9e95e168
                                                                • Instruction Fuzzy Hash: 8121A575905618EADFA09F60DC84AEF7BBCFF04324F108216E929EA1C0D7709985CF60
                                                                Function 007F0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • IsWindow.USER32(00000000), ref: 007F0951
                                                                • GetForegroundWindow.USER32 ref: 007F0968
                                                                • GetDC.USER32(00000000), ref: 007F09A4
                                                                • GetPixel.GDI32(00000000,?,00000003), ref: 007F09B0
                                                                • ReleaseDC.USER32(00000000,00000003), ref: 007F09E8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ForegroundPixelRelease
                                                                • String ID:
                                                                • API String ID: 4156661090-0
                                                                • Opcode ID: e1c098e59b088ceeb782d41802a78e696c331e9dc46c1b9b23995234f567fe62
                                                                • Instruction ID: 4eb99b446bcb7f7e4adefc276bb9a5eaa21842787f6fdfaf3553dbdef9cd5148
                                                                • Opcode Fuzzy Hash: e1c098e59b088ceeb782d41802a78e696c331e9dc46c1b9b23995234f567fe62
                                                                • Instruction Fuzzy Hash: 4E216F36600204EFD754EF65C889AAEBBE5FF48744F04856CF95A97362DB74AC04CB90
                                                                Function 007ACDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetEnvironmentStringsW.KERNEL32 ref: 007ACDC6
                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007ACDE9
                                                                  • Part of subcall function 007A3820: RtlAllocateHeap.NTDLL(00000000,?,00841444,?,0078FDF5,?,?,0077A976,00000010,00841440,007713FC,?,007713C6,?,00771129), ref: 007A3852
                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 007ACE0F
                                                                • _free.LIBCMT ref: 007ACE22
                                                                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 007ACE31
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                • String ID:
                                                                • API String ID: 336800556-0
                                                                • Opcode ID: b883e5843d957beb00956f29ec07c2c564ebd10836ca6ca4466c57d0cb1cd594
                                                                • Instruction ID: 5bbb68770c762e2529442943ed1d2fe288886a00b4cbfaab8a1d07712ed32b4e
                                                                • Opcode Fuzzy Hash: b883e5843d957beb00956f29ec07c2c564ebd10836ca6ca4466c57d0cb1cd594
                                                                • Instruction Fuzzy Hash: DF0184726052157F67221BBA6C8CD7B796DEEC7BA1315032DF905D7201EA698D0281F0
                                                                Function 00789639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00789693
                                                                • SelectObject.GDI32(?,00000000), ref: 007896A2
                                                                • BeginPath.GDI32(?), ref: 007896B9
                                                                • SelectObject.GDI32(?,00000000), ref: 007896E2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ObjectSelect$BeginCreatePath
                                                                • String ID:
                                                                • API String ID: 3225163088-0
                                                                • Opcode ID: 4fdb220d318d866d079418bcfa0cc879064bd4d95a76d67a34d4f4982282261b
                                                                • Instruction ID: 94d7aa81b24c0d4797b169ce4b56f02b52f857038fae9f9716f168230f96ccd5
                                                                • Opcode Fuzzy Hash: 4fdb220d318d866d079418bcfa0cc879064bd4d95a76d67a34d4f4982282261b
                                                                • Instruction Fuzzy Hash: 11215E34942305EFDF11AF64EC18BB97FA8BB52365F54421AF520A61B0E3789892CF94
                                                                Function 007D5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _memcmp
                                                                • String ID:
                                                                • API String ID: 2931989736-0
                                                                • Opcode ID: d7a8f6cd3159dd4140a7dcc17da5a8580c21dd718ef7c83d0703803843f78968
                                                                • Instruction ID: 0a426d7ef4d600d51cf6ecbceed8973d491474f4b5b8ecebc6c0d1c7e3796e84
                                                                • Opcode Fuzzy Hash: d7a8f6cd3159dd4140a7dcc17da5a8580c21dd718ef7c83d0703803843f78968
                                                                • Instruction Fuzzy Hash: 9E019661741615FBE61855109D46EBA737CEB213B4B604022FE149A781F66DED2086A0
                                                                Function 007A2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLastError.KERNEL32(?,?,?,0079F2DE,007A3863,00841444,?,0078FDF5,?,?,0077A976,00000010,00841440,007713FC,?,007713C6), ref: 007A2DFD
                                                                • _free.LIBCMT ref: 007A2E32
                                                                • _free.LIBCMT ref: 007A2E59
                                                                • SetLastError.KERNEL32(00000000,00771129), ref: 007A2E66
                                                                • SetLastError.KERNEL32(00000000,00771129), ref: 007A2E6F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$_free
                                                                • String ID:
                                                                • API String ID: 3170660625-0
                                                                • Opcode ID: 9943666229bda152216141da680649db98ac273ac8851679ca4c3b64537fc924
                                                                • Instruction ID: 3d9e6732031b9f38aa06c87d0d65b08e61cdd6819ee6984e1b5314137bdef32b
                                                                • Opcode Fuzzy Hash: 9943666229bda152216141da680649db98ac273ac8851679ca4c3b64537fc924
                                                                • Instruction Fuzzy Hash: C601F43220D600ABC6122B3D6C4EE2B2659BBD37B5B210728F425E22D3EB7CCC434521
                                                                Function 007D000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?,?,?,007D035E), ref: 007D002B
                                                                • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?,?), ref: 007D0046
                                                                • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?,?), ref: 007D0054
                                                                • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?), ref: 007D0064
                                                                • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007CFF41,80070057,?,?), ref: 007D0070
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                • String ID:
                                                                • API String ID: 3897988419-0
                                                                • Opcode ID: 19fbb0ab669f3fdc800e7f0796e91f3f6839770747ae30fffac295c9dad81d46
                                                                • Instruction ID: 3249d05b095942cc10ee57f08cee91ba4c5fccdc7014119ac8f41d66f53f480f
                                                                • Opcode Fuzzy Hash: 19fbb0ab669f3fdc800e7f0796e91f3f6839770747ae30fffac295c9dad81d46
                                                                • Instruction Fuzzy Hash: 0501AD76600204BFDB504F68DC08BAA7AFDFF887A2F149225F905D2310E779DD409BA0
                                                                Function 007DE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • QueryPerformanceCounter.KERNEL32(?), ref: 007DE997
                                                                • QueryPerformanceFrequency.KERNEL32(?), ref: 007DE9A5
                                                                • Sleep.KERNEL32(00000000), ref: 007DE9AD
                                                                • QueryPerformanceCounter.KERNEL32(?), ref: 007DE9B7
                                                                • Sleep.KERNEL32 ref: 007DE9F3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                • String ID:
                                                                • API String ID: 2833360925-0
                                                                • Opcode ID: 7f2b2205174d185bba5888747abda87285012c183c026e8bd30c069c7b529172
                                                                • Instruction ID: d2afc8331a2db4ca34c157ed580317439454614bf4a01d9d441dd66d34f3d1b6
                                                                • Opcode Fuzzy Hash: 7f2b2205174d185bba5888747abda87285012c183c026e8bd30c069c7b529172
                                                                • Instruction Fuzzy Hash: EB018C31D0262DDBCF41AFE4DC69AEDBB78FF08300F000656E502B6241DB38A551CBA2
                                                                Function 007D10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 007D1114
                                                                • GetLastError.KERNEL32(?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D1120
                                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D112F
                                                                • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,007D0B9B,?,?,?), ref: 007D1136
                                                                • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 007D114D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                • String ID:
                                                                • API String ID: 842720411-0
                                                                • Opcode ID: 3b641a0bfe9cd87b085f77ce31bf2fd926614625304510d49654168c659b0117
                                                                • Instruction ID: 38c74eef03aa99571ffa5c7d95c78a88b2ca711be7cf14b243bbd205fd19e6b5
                                                                • Opcode Fuzzy Hash: 3b641a0bfe9cd87b085f77ce31bf2fd926614625304510d49654168c659b0117
                                                                • Instruction Fuzzy Hash: 2B013C75200209BFEB514FA9DC59E6A3F7EFF893A0B614519FA45D7360DB31DC009A60
                                                                Function 007D0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007D0FCA
                                                                • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007D0FD6
                                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007D0FE5
                                                                • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007D0FEC
                                                                • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007D1002
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                • String ID:
                                                                • API String ID: 44706859-0
                                                                • Opcode ID: a24f92e4a45c2bc30e323423a9f00a8511a21e3d940f68b54a7296afa1aa1c46
                                                                • Instruction ID: 5bd5f9dffeb603b94ec853043cc70a03ae6c02a915903fa906f40cdab6358619
                                                                • Opcode Fuzzy Hash: a24f92e4a45c2bc30e323423a9f00a8511a21e3d940f68b54a7296afa1aa1c46
                                                                • Instruction Fuzzy Hash: 44F04935200301BBDB215FA4AC49F563BBDFF89762F514515FA45D62A1CA74DC408A60
                                                                Function 007D1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 007D102A
                                                                • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 007D1036
                                                                • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007D1045
                                                                • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 007D104C
                                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007D1062
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                • String ID:
                                                                • API String ID: 44706859-0
                                                                • Opcode ID: f51f1b8727a4d7c035d0922e36f4d0350d427937439dcf5e172280f8ec7bdf3a
                                                                • Instruction ID: 6e6f700b39effe1b44ac059c07e8973f5c372ffbf35aa545df4baa02f9155af6
                                                                • Opcode Fuzzy Hash: f51f1b8727a4d7c035d0922e36f4d0350d427937439dcf5e172280f8ec7bdf3a
                                                                • Instruction Fuzzy Hash: D1F0443A200301BBDB226FA4EC49F5A3BBEFF8A761F510515FA45C62A0CA74D8408A60
                                                                Function 007E030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CloseHandle.KERNEL32(?,?,?,?,007E017D,?,007E32FC,?,00000001,007B2592,?), ref: 007E0324
                                                                • CloseHandle.KERNEL32(?,?,?,?,007E017D,?,007E32FC,?,00000001,007B2592,?), ref: 007E0331
                                                                • CloseHandle.KERNEL32(?,?,?,?,007E017D,?,007E32FC,?,00000001,007B2592,?), ref: 007E033E
                                                                • CloseHandle.KERNEL32(?,?,?,?,007E017D,?,007E32FC,?,00000001,007B2592,?), ref: 007E034B
                                                                • CloseHandle.KERNEL32(?,?,?,?,007E017D,?,007E32FC,?,00000001,007B2592,?), ref: 007E0358
                                                                • CloseHandle.KERNEL32(?,?,?,?,007E017D,?,007E32FC,?,00000001,007B2592,?), ref: 007E0365
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseHandle
                                                                • String ID:
                                                                • API String ID: 2962429428-0
                                                                • Opcode ID: cbe58d127241ca86b34a3736e1798663ee617fd43665f320920025b24dc4aa4e
                                                                • Instruction ID: 32c1e21aaef8f650c309f10ac36717999e135858d40e32789b7986eb3d09126b
                                                                • Opcode Fuzzy Hash: cbe58d127241ca86b34a3736e1798663ee617fd43665f320920025b24dc4aa4e
                                                                • Instruction Fuzzy Hash: 9401AE72802B559FCB30AF66D880812FBF9BF643153158A3FD19652931C3B5A998CF80
                                                                Function 007AD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • _free.LIBCMT ref: 007AD752
                                                                  • Part of subcall function 007A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000), ref: 007A29DE
                                                                  • Part of subcall function 007A29C8: GetLastError.KERNEL32(00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000,00000000), ref: 007A29F0
                                                                • _free.LIBCMT ref: 007AD764
                                                                • _free.LIBCMT ref: 007AD776
                                                                • _free.LIBCMT ref: 007AD788
                                                                • _free.LIBCMT ref: 007AD79A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast
                                                                • String ID:
                                                                • API String ID: 776569668-0
                                                                • Opcode ID: a483ecdc4ee9bf8141c863139ff85c74ccb73295f3120bb2ef06c0cb0cc789ac
                                                                • Instruction ID: c0a2b5f5b2de809d1b9c21b6cb5455bfaca27207ff0037d034eeee9447499455
                                                                • Opcode Fuzzy Hash: a483ecdc4ee9bf8141c863139ff85c74ccb73295f3120bb2ef06c0cb0cc789ac
                                                                • Instruction Fuzzy Hash: E1F0FF32544208AF8665EB68F9C5C2B7BDDBBC6710B950E05F449F7922C728FC808B65
                                                                Function 007D5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDlgItem.USER32(?,000003E9), ref: 007D5C58
                                                                • GetWindowTextW.USER32(00000000,?,00000100), ref: 007D5C6F
                                                                • MessageBeep.USER32(00000000), ref: 007D5C87
                                                                • KillTimer.USER32(?,0000040A), ref: 007D5CA3
                                                                • EndDialog.USER32(?,00000001), ref: 007D5CBD
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                • String ID:
                                                                • API String ID: 3741023627-0
                                                                • Opcode ID: 5bd36fa7d8a30cdc2a85de7fd1f856e91ace2555b94e03fff6d99afec10ce431
                                                                • Instruction ID: d800aef2a1353da5e87c2709b48745a8d904140523dd843432b6488c848f4b69
                                                                • Opcode Fuzzy Hash: 5bd36fa7d8a30cdc2a85de7fd1f856e91ace2555b94e03fff6d99afec10ce431
                                                                • Instruction Fuzzy Hash: E001D630500B04AFEB305F10DD4EFA67BB8BB10B41F04165EA597A11E1DBF5AD848AA0
                                                                Function 007A22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _free.LIBCMT ref: 007A22BE
                                                                  • Part of subcall function 007A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000), ref: 007A29DE
                                                                  • Part of subcall function 007A29C8: GetLastError.KERNEL32(00000000,?,007AD7D1,00000000,00000000,00000000,00000000,?,007AD7F8,00000000,00000007,00000000,?,007ADBF5,00000000,00000000), ref: 007A29F0
                                                                • _free.LIBCMT ref: 007A22D0
                                                                • _free.LIBCMT ref: 007A22E3
                                                                • _free.LIBCMT ref: 007A22F4
                                                                • _free.LIBCMT ref: 007A2305
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast
                                                                • String ID:
                                                                • API String ID: 776569668-0
                                                                • Opcode ID: 27622e7d41b7423a4c96e545da3248cb508fd18fad1c56581e37edc59267895f
                                                                • Instruction ID: 86bbd0ba95afcdc38507b468775d8ea838fa9b0049df72206a27f855bc058881
                                                                • Opcode Fuzzy Hash: 27622e7d41b7423a4c96e545da3248cb508fd18fad1c56581e37edc59267895f
                                                                • Instruction Fuzzy Hash: 81F05478400220CF8B52EF68BC0580A3B64F79BB51701071AF514E22F6CB3C1552EFE5
                                                                Function 007895C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • EndPath.GDI32(?), ref: 007895D4
                                                                • StrokeAndFillPath.GDI32(?,?,007C71F7,00000000,?,?,?), ref: 007895F0
                                                                • SelectObject.GDI32(?,00000000), ref: 00789603
                                                                • DeleteObject.GDI32 ref: 00789616
                                                                • StrokePath.GDI32(?), ref: 00789631
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                • String ID:
                                                                • API String ID: 2625713937-0
                                                                • Opcode ID: d673a2649e0728f83cb29502c2718cef8285bd5eb098870f732684d8d4658240
                                                                • Instruction ID: 1422cd10c348e4a317eeb68d0315d6731017307ea9c1f011dff7358becc155f8
                                                                • Opcode Fuzzy Hash: d673a2649e0728f83cb29502c2718cef8285bd5eb098870f732684d8d4658240
                                                                • Instruction Fuzzy Hash: 00F03739046608EBDB226F69ED1CBB43F61BB02322F488314F529550F0D73489A1DF20
                                                                Function 007A0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: __freea$_free
                                                                • String ID: a/p$am/pm
                                                                • API String ID: 3432400110-3206640213
                                                                • Opcode ID: 3f352d53110a1cd50b202d4e30cd53b4f7e16d8a42e4084b624d88fc76321086
                                                                • Instruction ID: f0cf1be93f14e190d97668f6d62b9c117390c2b73266bad8eb17d0f18805b224
                                                                • Opcode Fuzzy Hash: 3f352d53110a1cd50b202d4e30cd53b4f7e16d8a42e4084b624d88fc76321086
                                                                • Instruction Fuzzy Hash: DDD1E535A00206DAEF289F68C855BFAB7B5FF87310FA84359E501AB650D37D9D80CB91
                                                                Function 007A5AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: JOw
                                                                • API String ID: 0-1003251281
                                                                • Opcode ID: cb6c8b6347abe44b53fccb28e69b7513c3124af8ebf7bb48d5338d6512730b38
                                                                • Instruction ID: 2197b3d37ce754d676e0f2f95af56d543cc432ab668f694bf0ec9f006d0fcbef
                                                                • Opcode Fuzzy Hash: cb6c8b6347abe44b53fccb28e69b7513c3124af8ebf7bb48d5338d6512730b38
                                                                • Instruction Fuzzy Hash: 685191B5D0060AEFCF119FA4D849FAE7BB8AF86320F14025AF505A7292D63D9901CB71
                                                                Function 007A8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 007A8B6E
                                                                • GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 007A8B7A
                                                                • __dosmaperr.LIBCMT ref: 007A8B81
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharErrorLastMultiWide__dosmaperr
                                                                • String ID: .y
                                                                • API String ID: 2434981716-2155845462
                                                                • Opcode ID: c2200cbd0bd742554cd8f6e25a83331a8447c523ff747c59c82d9512fe5f263c
                                                                • Instruction ID: 2f69360c8797373c2d25d5b174fdfe9018e25f8c9424ab9cb781803ee4abaa41
                                                                • Opcode Fuzzy Hash: c2200cbd0bd742554cd8f6e25a83331a8447c523ff747c59c82d9512fe5f263c
                                                                • Instruction Fuzzy Hash: 6F418EF0604145AFCB649F64C884A7E7FA5EBC7300B2883A9F89587242DE39CC02C7A1
                                                                Function 007D2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007DB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007D21D0,?,?,00000034,00000800,?,00000034), ref: 007DB42D
                                                                • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 007D2760
                                                                  • Part of subcall function 007DB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007D21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 007DB3F8
                                                                  • Part of subcall function 007DB32A: GetWindowThreadProcessId.USER32(?,?), ref: 007DB355
                                                                  • Part of subcall function 007DB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,007D2194,00000034,?,?,00001004,00000000,00000000), ref: 007DB365
                                                                  • Part of subcall function 007DB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,007D2194,00000034,?,?,00001004,00000000,00000000), ref: 007DB37B
                                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007D27CD
                                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007D281A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                • String ID: @
                                                                • API String ID: 4150878124-2766056989
                                                                • Opcode ID: 0e6b5e6dfa26354228b79164b481d769afd6c1e9f4d3373152c90cbe37fa98f0
                                                                • Instruction ID: 200013a4a2f6cb827483f78adb66f2b079797bbb7c9d5c39fb7ece82850c796e
                                                                • Opcode Fuzzy Hash: 0e6b5e6dfa26354228b79164b481d769afd6c1e9f4d3373152c90cbe37fa98f0
                                                                • Instruction Fuzzy Hash: B3413C72900218EFDB10DFA4CD45AEEBBB8EF19300F00405AFA55B7281DB756E46DBA0
                                                                Function 007A172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 007A1769
                                                                • _free.LIBCMT ref: 007A1834
                                                                • _free.LIBCMT ref: 007A183E
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$FileModuleName
                                                                • String ID: C:\Users\user\Desktop\file.exe
                                                                • API String ID: 2506810119-517116171
                                                                • Opcode ID: bace9fbf73b93a7e852bf8734eb2f27f148b635018f7554afd11aff9ff71419f
                                                                • Instruction ID: 418c70beaf58d6a868683748a9614f48e6786b37f8f648d3f45a713ae06b0b05
                                                                • Opcode Fuzzy Hash: bace9fbf73b93a7e852bf8734eb2f27f148b635018f7554afd11aff9ff71419f
                                                                • Instruction Fuzzy Hash: CC319375A00218EFEB21DF99D889D9EBBFCEBC6320F504266F504D7211D6B88E40CB90
                                                                Function 007DC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 007DC306
                                                                • DeleteMenu.USER32(?,00000007,00000000), ref: 007DC34C
                                                                • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00841990,016556E0), ref: 007DC395
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$Delete$InfoItem
                                                                • String ID: 0
                                                                • API String ID: 135850232-4108050209
                                                                • Opcode ID: 1e78d72c106fe2a3b7c0c63bbb9b8f85de808a9b255c6389b7731be589a2bd84
                                                                • Instruction ID: 86f619cf4528184820e1ebe60e3c7cc4d9bdf9f2b5bce75795c62f7ad9cc56a2
                                                                • Opcode Fuzzy Hash: 1e78d72c106fe2a3b7c0c63bbb9b8f85de808a9b255c6389b7731be589a2bd84
                                                                • Instruction Fuzzy Hash: 68418E31204342DFDB25DF28D885B1ABBA4AF85310F10861EF9A5973D1D738A904CB62
                                                                Function 00804416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0080CC08,00000000,?,?,?,?), ref: 008044AA
                                                                • GetWindowLongW.USER32 ref: 008044C7
                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 008044D7
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Long
                                                                • String ID: SysTreeView32
                                                                • API String ID: 847901565-1698111956
                                                                • Opcode ID: fd68822deb9dc0564f04f161bc605a4f4e4abc34974b63b9267b82947ff1f708
                                                                • Instruction ID: ecadae44e1b66756fc370c5684ccd17f2364bde0a395d17a3d0bc2def5e7f8e4
                                                                • Opcode Fuzzy Hash: fd68822deb9dc0564f04f161bc605a4f4e4abc34974b63b9267b82947ff1f708
                                                                • Instruction Fuzzy Hash: 72319C72240605ABDF609F38DC45BEA7BA9FB08324F205315FA79E22E0D774EC509750
                                                                Function 007D6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SysReAllocString.OLEAUT32(?,?), ref: 007D6EED
                                                                • VariantCopyInd.OLEAUT32(?,?), ref: 007D6F08
                                                                • VariantClear.OLEAUT32(?), ref: 007D6F12
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$AllocClearCopyString
                                                                • String ID: *j}
                                                                • API String ID: 2173805711-2067633288
                                                                • Opcode ID: cf15679027912b74ee4ee242db9c171de19661ed0cb63a37b45d8dc7b2cc9afc
                                                                • Instruction ID: 848710b8303ae7a5674785ae2fb1e4701d126311edf848b6893df1b757107c80
                                                                • Opcode Fuzzy Hash: cf15679027912b74ee4ee242db9c171de19661ed0cb63a37b45d8dc7b2cc9afc
                                                                • Instruction Fuzzy Hash: 6831E2B1604A05DFCF04AFA4E8959BE3776FF85B04B1044AAF8029B3A1C7389D11CBD0
                                                                Function 007F304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007F335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,007F3077,?,?), ref: 007F3378
                                                                • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 007F307A
                                                                • _wcslen.LIBCMT ref: 007F309B
                                                                • htons.WSOCK32(00000000,?,?,00000000), ref: 007F3106
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                                • String ID: 255.255.255.255
                                                                • API String ID: 946324512-2422070025
                                                                • Opcode ID: 36b076f095f84f93701cb02248fb7b05082cd5459b35c4526bd52b100eb41702
                                                                • Instruction ID: b3652a3fcb1cbc183b73ab3ca6a9dd4d0dc43254f3e4a36c125d00be6fda7011
                                                                • Opcode Fuzzy Hash: 36b076f095f84f93701cb02248fb7b05082cd5459b35c4526bd52b100eb41702
                                                                • Instruction Fuzzy Hash: 06310435200209DFCB10CF28C485EBA77E1EF14318F24C15AEA158B392DB3AEE45C761
                                                                Function 00803EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00803F40
                                                                • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00803F54
                                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00803F78
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$Window
                                                                • String ID: SysMonthCal32
                                                                • API String ID: 2326795674-1439706946
                                                                • Opcode ID: fe9faa6971e667075a43f654bef902d07aa60fb47a9ccf25710b40c1ad7a39c1
                                                                • Instruction ID: 324b1707abf3cbfea6fea625a6dce2e5a4f4eb623d9d6e6e66074f387e749d5f
                                                                • Opcode Fuzzy Hash: fe9faa6971e667075a43f654bef902d07aa60fb47a9ccf25710b40c1ad7a39c1
                                                                • Instruction Fuzzy Hash: 0E219C32600219BBDF219F54DC46FEA3B79FF48714F110214FA19AB1D0DAB5A991CBA0
                                                                Function 00804653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00804705
                                                                • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00804713
                                                                • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0080471A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$DestroyWindow
                                                                • String ID: msctls_updown32
                                                                • API String ID: 4014797782-2298589950
                                                                • Opcode ID: a6d7f16ae5afbd830b0af0fe09c0d139a1a79caf2582739aeab63b73a78ce678
                                                                • Instruction ID: 7e3a9e06d1f7a0a364d4ae67dd05fa7adcc25af0c119885b7f49977d58e6e0da
                                                                • Opcode Fuzzy Hash: a6d7f16ae5afbd830b0af0fe09c0d139a1a79caf2582739aeab63b73a78ce678
                                                                • Instruction Fuzzy Hash: 9C215EF5600208AFEB50DF68DC95DA73BADFB5A394B040459FA11DB2A1DB31EC51CA60
                                                                Function 007D95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen
                                                                • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                • API String ID: 176396367-2734436370
                                                                • Opcode ID: 4ffada493680d803ab33ff9062d01ab8058a3c5804e3a2412321306fd4a47598
                                                                • Instruction ID: 04c48fa2fbad06fc682b9634483d89c54863e6384238e1664177da982221e6f0
                                                                • Opcode Fuzzy Hash: 4ffada493680d803ab33ff9062d01ab8058a3c5804e3a2412321306fd4a47598
                                                                • Instruction Fuzzy Hash: 3B212632204511A6C731BA24AC16FA773B8AF51310F148027FB5A97282EB5DED51C395
                                                                Function 008037B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00803840
                                                                • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00803850
                                                                • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00803876
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$MoveWindow
                                                                • String ID: Listbox
                                                                • API String ID: 3315199576-2633736733
                                                                • Opcode ID: 2aa4f12bd5753fae0daf63eda6a47d045d1911e6d10013f9db221b986b784de8
                                                                • Instruction ID: f673254fb3fb6e1104bd7dd10ee5513b159e2538cfaed964673d99badbb4dad2
                                                                • Opcode Fuzzy Hash: 2aa4f12bd5753fae0daf63eda6a47d045d1911e6d10013f9db221b986b784de8
                                                                • Instruction Fuzzy Hash: 27218E72610218BBEF619F54CC85EAB376EFF89754F108124F9549B1D0CA71DC5287A0
                                                                Function 007E49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetErrorMode.KERNEL32(00000001), ref: 007E4A08
                                                                • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 007E4A5C
                                                                • SetErrorMode.KERNEL32(00000000,?,?,0080CC08), ref: 007E4AD0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$InformationVolume
                                                                • String ID: %lu
                                                                • API String ID: 2507767853-685833217
                                                                • Opcode ID: 84815949b249ad822608d144ffdc42783cfd2a5a2e8d3df802dc1ba350c016d2
                                                                • Instruction ID: dba0cda38dd96052e69cad7e81242a09cefd5085d1eb047348a0a991a78c4b11
                                                                • Opcode Fuzzy Hash: 84815949b249ad822608d144ffdc42783cfd2a5a2e8d3df802dc1ba350c016d2
                                                                • Instruction Fuzzy Hash: BF313E75A00109EFDB10DF64C885EAABBF8EF08318F1480A5E909DB352D775EE45CB61
                                                                Function 008041EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0080424F
                                                                • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00804264
                                                                • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00804271
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend
                                                                • String ID: msctls_trackbar32
                                                                • API String ID: 3850602802-1010561917
                                                                • Opcode ID: 5a316ccd7cd0f1c59ce88369033498a6771d80b3ed74d0b48a08a4862ac98136
                                                                • Instruction ID: c59b42e15a415e810b3f9ebc0f5569545fcc59493ec17101cb0c7827e9ba9ce0
                                                                • Opcode Fuzzy Hash: 5a316ccd7cd0f1c59ce88369033498a6771d80b3ed74d0b48a08a4862ac98136
                                                                • Instruction Fuzzy Hash: 6A11A371380248BEEF605F69CC06FAB3BACFF95B54F110528FA55E60D0D671D8619B50
                                                                Function 007D2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00776B57: _wcslen.LIBCMT ref: 00776B6A
                                                                  • Part of subcall function 007D2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 007D2DC5
                                                                  • Part of subcall function 007D2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 007D2DD6
                                                                  • Part of subcall function 007D2DA7: GetCurrentThreadId.KERNEL32 ref: 007D2DDD
                                                                  • Part of subcall function 007D2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 007D2DE4
                                                                • GetFocus.USER32 ref: 007D2F78
                                                                  • Part of subcall function 007D2DEE: GetParent.USER32(00000000), ref: 007D2DF9
                                                                • GetClassNameW.USER32(?,?,00000100), ref: 007D2FC3
                                                                • EnumChildWindows.USER32(?,007D303B), ref: 007D2FEB
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                                • String ID: %s%d
                                                                • API String ID: 1272988791-1110647743
                                                                • Opcode ID: 7cf04cbbb8de9a0e245cc4df8c8b9dfe45b13c91ca65fd5deb3928637197ec9b
                                                                • Instruction ID: 6473c2ac3a812a5f69982c0ef89ca5327dedfa5aec417f6b66c743214117fe29
                                                                • Opcode Fuzzy Hash: 7cf04cbbb8de9a0e245cc4df8c8b9dfe45b13c91ca65fd5deb3928637197ec9b
                                                                • Instruction Fuzzy Hash: 1111E7B1300205ABCF547F708C89EED377AAFA4304F048076F9199B393DE395A0A8B60
                                                                Function 00805882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 008058C1
                                                                • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 008058EE
                                                                • DrawMenuBar.USER32(?), ref: 008058FD
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$InfoItem$Draw
                                                                • String ID: 0
                                                                • API String ID: 3227129158-4108050209
                                                                • Opcode ID: 8895f7e717232bfd09a579d3177310ed736affeb57e77cef7f8b672644f6e477
                                                                • Instruction ID: dce3182987a3c75eb38f77018d9fa01c68bc0a0ac598287aa0d8178d93bde1b7
                                                                • Opcode Fuzzy Hash: 8895f7e717232bfd09a579d3177310ed736affeb57e77cef7f8b672644f6e477
                                                                • Instruction Fuzzy Hash: 0E016935500218EFDBA19F11EC48BAFBBB4FB45361F1080A9E849D61A1DB308A94EF31
                                                                Function 007CD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 007CD3BF
                                                                • FreeLibrary.KERNEL32 ref: 007CD3E5
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeLibraryProc
                                                                • String ID: GetSystemWow64DirectoryW$X64
                                                                • API String ID: 3013587201-2590602151
                                                                • Opcode ID: 46aa0cc3841b48c50d61d5b1338fcb270a5d55cfe12d73ee63b9dee36d9d4e08
                                                                • Instruction ID: 7be1d7a15146643ac97978f4d0a8ba822cdaade851a42881638bd14e1e6947ce
                                                                • Opcode Fuzzy Hash: 46aa0cc3841b48c50d61d5b1338fcb270a5d55cfe12d73ee63b9dee36d9d4e08
                                                                • Instruction Fuzzy Hash: 2CF05572806A219BD7B12B204C24F2A7710FF22B20F69437CE002E21C0E72CCC4483C2
                                                                Function 007D007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0a26b88804aa211f9131dc5a6e7b0d949350f547b2ab757de119e6616940252f
                                                                • Instruction ID: 61faf3e71c389e056894841d1e97a38d02db9b000f37ed248b13321e52b9f1e8
                                                                • Opcode Fuzzy Hash: 0a26b88804aa211f9131dc5a6e7b0d949350f547b2ab757de119e6616940252f
                                                                • Instruction Fuzzy Hash: C9C14675A0020AEFCB14CFA8C898BAEB7B5FF48314F209599E505EB251D735EE41DB90
                                                                Function 007F342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearInitInitializeUninitialize
                                                                • String ID:
                                                                • API String ID: 1998397398-0
                                                                • Opcode ID: 4db3ea8acf5b4115f3f6bd876793dae93cf19eec4c3730a37b30877a18f0e30b
                                                                • Instruction ID: 19d8fbc110c47408343986941de1749f278077ab6832f73d110947afc9488c11
                                                                • Opcode Fuzzy Hash: 4db3ea8acf5b4115f3f6bd876793dae93cf19eec4c3730a37b30877a18f0e30b
                                                                • Instruction Fuzzy Hash: 7BA13B75604204DFCB04EF24C489A2AB7E5FF88754F148959F98A9B362DB38EE01CB91
                                                                Function 007D0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0080FC08,?), ref: 007D05F0
                                                                • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0080FC08,?), ref: 007D0608
                                                                • CLSIDFromProgID.OLE32(?,?,00000000,0080CC40,000000FF,?,00000000,00000800,00000000,?,0080FC08,?), ref: 007D062D
                                                                • _memcmp.LIBVCRUNTIME ref: 007D064E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FromProg$FreeTask_memcmp
                                                                • String ID:
                                                                • API String ID: 314563124-0
                                                                • Opcode ID: 7a33facda952a3c25e9510e7e229cde3f9646bbedd88d70212b23c92c2d03573
                                                                • Instruction ID: 5a67900edb2efc4000579d7750ff8ccaf2b950ee6e448423256dcedff53a710c
                                                                • Opcode Fuzzy Hash: 7a33facda952a3c25e9510e7e229cde3f9646bbedd88d70212b23c92c2d03573
                                                                • Instruction Fuzzy Hash: EF811B71A00109EFCB04DF94C988EEEB7B9FF89315F204559E506AB250DB75AE06CBA0
                                                                Function 007FA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 007FA6AC
                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 007FA6BA
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • Process32NextW.KERNEL32(00000000,?), ref: 007FA79C
                                                                • CloseHandle.KERNEL32(00000000), ref: 007FA7AB
                                                                  • Part of subcall function 0078CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,007B3303,?), ref: 0078CE8A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                                • String ID:
                                                                • API String ID: 1991900642-0
                                                                • Opcode ID: f552fd519d366c11930672edd78606182091902256dcaf0c6a757f1a8c9117e8
                                                                • Instruction ID: 8c54a0308c278c35504b34f363b4c09c0e587579b42ec74e078418c619d0ef02
                                                                • Opcode Fuzzy Hash: f552fd519d366c11930672edd78606182091902256dcaf0c6a757f1a8c9117e8
                                                                • Instruction Fuzzy Hash: C351FC71508300EFD710EF24C886A6BBBE8FF89754F40892DF59997252EB74D905CB92
                                                                Function 007B1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _free
                                                                • String ID:
                                                                • API String ID: 269201875-0
                                                                • Opcode ID: 186428d6a2ab3b4d14cad0e14c4a20a623a74fe069604f6f70725b01109a0623
                                                                • Instruction ID: 09aae592ad197d860381111067ca6fb00e8a38cbb07c91f8e1e618f471b2b8c0
                                                                • Opcode Fuzzy Hash: 186428d6a2ab3b4d14cad0e14c4a20a623a74fe069604f6f70725b01109a0623
                                                                • Instruction Fuzzy Hash: C2412B31600140EBDF216BBD9C5ABEE3AA4FF86370FE44325F419D7192E63C49519762
                                                                Function 00806278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowRect.USER32(?,?), ref: 008062E2
                                                                • ScreenToClient.USER32(?,?), ref: 00806315
                                                                • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00806382
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ClientMoveRectScreen
                                                                • String ID:
                                                                • API String ID: 3880355969-0
                                                                • Opcode ID: 8b5b519e79f84c468d689108c9bda59c165dd87774973bad790dc09b07a98dd2
                                                                • Instruction ID: 1e329c5dcd27a396f108b4f7e94b2c79c17600b49e9b31eab064150fe4f38319
                                                                • Opcode Fuzzy Hash: 8b5b519e79f84c468d689108c9bda59c165dd87774973bad790dc09b07a98dd2
                                                                • Instruction Fuzzy Hash: 76511974A00209EFDF60DF68D884AAE7BB5FB45360F118259F815D7290E731ADA1CB90
                                                                Function 007F1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • socket.WSOCK32(00000002,00000002,00000011), ref: 007F1AFD
                                                                • WSAGetLastError.WSOCK32 ref: 007F1B0B
                                                                • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 007F1B8A
                                                                • WSAGetLastError.WSOCK32 ref: 007F1B94
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$socket
                                                                • String ID:
                                                                • API String ID: 1881357543-0
                                                                • Opcode ID: 0b54ed27e286b39dd2fa0242d0344cfb47b0ec9ee94e83388a4dd7edde00f5d7
                                                                • Instruction ID: 7b1dce417f0eea99406208e30cdd90de697d2ea2c308a0af7647a74a54327d8c
                                                                • Opcode Fuzzy Hash: 0b54ed27e286b39dd2fa0242d0344cfb47b0ec9ee94e83388a4dd7edde00f5d7
                                                                • Instruction Fuzzy Hash: CC41AD74640200EFEB20AF24C88AF2977A5AB49718F54C458FA1A9F393D67ADD41CB90
                                                                Function 007AB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b8ba284ed1200281641c4abd155b239b76932701893ca4dd453563515fea1440
                                                                • Instruction ID: 004032caa0e4054632196ab684da7ab349d871ca4012cf67085c4f7a15d1d5fd
                                                                • Opcode Fuzzy Hash: b8ba284ed1200281641c4abd155b239b76932701893ca4dd453563515fea1440
                                                                • Instruction Fuzzy Hash: 6641F372A00344FFD7249F78CC45BAABBA9EBC9710F10462AF541DB283D779A9018780
                                                                Function 007E56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 007E5783
                                                                • GetLastError.KERNEL32(?,00000000), ref: 007E57A9
                                                                • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 007E57CE
                                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 007E57FA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateHardLink$DeleteErrorFileLast
                                                                • String ID:
                                                                • API String ID: 3321077145-0
                                                                • Opcode ID: 8c89c63cd8677fd1b15a3e9268ecd40cb65ed86114a9680c54209df90b8cc1d2
                                                                • Instruction ID: 06aad4a7ebc22b7403c07dc221c9c3919cb591fda24219af0d5bd0c05e5d64ed
                                                                • Opcode Fuzzy Hash: 8c89c63cd8677fd1b15a3e9268ecd40cb65ed86114a9680c54209df90b8cc1d2
                                                                • Instruction Fuzzy Hash: 81412D35600610DFCF15EF15C548A1DBBE2EF89764B19C888E84A5B362CB38FD10CB91
                                                                Function 007AD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(?,00000000,?,00796D71,00000000,00000000,007982D9,?,007982D9,?,00000001,00796D71,?,00000001,007982D9,007982D9), ref: 007AD910
                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007AD999
                                                                • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 007AD9AB
                                                                • __freea.LIBCMT ref: 007AD9B4
                                                                  • Part of subcall function 007A3820: RtlAllocateHeap.NTDLL(00000000,?,00841444,?,0078FDF5,?,?,0077A976,00000010,00841440,007713FC,?,007713C6,?,00771129), ref: 007A3852
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                • String ID:
                                                                • API String ID: 2652629310-0
                                                                • Opcode ID: ccc63b07caedfd14f8d93a708d21761d68fca9082db96511c9cbaa49fb4eb173
                                                                • Instruction ID: 094069c7324d0c97b1836addc182516edbdd92d0d7e89efd8a2bdadcc8163309
                                                                • Opcode Fuzzy Hash: ccc63b07caedfd14f8d93a708d21761d68fca9082db96511c9cbaa49fb4eb173
                                                                • Instruction Fuzzy Hash: 8331B072A0020AABDF249F65DC45EAF7BA5EF82310F054268FC05D7251EB39DD54CB90
                                                                Function 008052C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,00001024,00000000,?), ref: 00805352
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00805375
                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00805382
                                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008053A8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: LongWindow$InvalidateMessageRectSend
                                                                • String ID:
                                                                • API String ID: 3340791633-0
                                                                • Opcode ID: 6032470a2af5f4731f5fbfdb46d53f20d1e589130d25c0e28c27d33ed06e531c
                                                                • Instruction ID: 88fc7e7f65c766dd04f650854051f537c7fdc7b7440f265b69d1023cfba6cdf5
                                                                • Opcode Fuzzy Hash: 6032470a2af5f4731f5fbfdb46d53f20d1e589130d25c0e28c27d33ed06e531c
                                                                • Instruction Fuzzy Hash: BC31AE34A55A0CAEEBB09E14CC16BEA7B65FB06390F594101BA11D63E0C7B0A9809F62
                                                                Function 007DAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 007DABF1
                                                                • SetKeyboardState.USER32(00000080,?,00008000), ref: 007DAC0D
                                                                • PostMessageW.USER32(00000000,00000101,00000000), ref: 007DAC74
                                                                • SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 007DACC6
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: KeyboardState$InputMessagePostSend
                                                                • String ID:
                                                                • API String ID: 432972143-0
                                                                • Opcode ID: a6d908a928c32568a211b971bdd93e425a07348affbe196f7a8092b7c57567ed
                                                                • Instruction ID: 149a8236a13ec009adfd3eabbf651ec72b66e0f599fcc26eaeb1dc5883b4e041
                                                                • Opcode Fuzzy Hash: a6d908a928c32568a211b971bdd93e425a07348affbe196f7a8092b7c57567ed
                                                                • Instruction Fuzzy Hash: 5F31F630A60618BFEB358B658C087FA7BB5BB85320F04431BE499523D1D37D99858772
                                                                Function 00807674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ClientToScreen.USER32(?,?), ref: 0080769A
                                                                • GetWindowRect.USER32(?,?), ref: 00807710
                                                                • PtInRect.USER32(?,?,00808B89), ref: 00807720
                                                                • MessageBeep.USER32(00000000), ref: 0080778C
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Rect$BeepClientMessageScreenWindow
                                                                • String ID:
                                                                • API String ID: 1352109105-0
                                                                • Opcode ID: a83ce690b9d78005371035be3ba7be3419f2522e3b991bebda0ecedbeb98530b
                                                                • Instruction ID: 4cc1b0ee45f0a2e0d3d59e29a140700c46c7837fb4504553be91dd844000d11d
                                                                • Opcode Fuzzy Hash: a83ce690b9d78005371035be3ba7be3419f2522e3b991bebda0ecedbeb98530b
                                                                • Instruction Fuzzy Hash: E2418D38A052549FDB91CF58CC94EA9BBF4FF49344F1481A9E414DB2A1C371B981CB90
                                                                Function 008016DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetForegroundWindow.USER32 ref: 008016EB
                                                                  • Part of subcall function 007D3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 007D3A57
                                                                  • Part of subcall function 007D3A3D: GetCurrentThreadId.KERNEL32 ref: 007D3A5E
                                                                  • Part of subcall function 007D3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007D25B3), ref: 007D3A65
                                                                • GetCaretPos.USER32(?), ref: 008016FF
                                                                • ClientToScreen.USER32(00000000,?), ref: 0080174C
                                                                • GetForegroundWindow.USER32 ref: 00801752
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                • String ID:
                                                                • API String ID: 2759813231-0
                                                                • Opcode ID: c7acee2708559ba9e82776faf72953a4b617b977718f8ff3e1fb042fff1953e6
                                                                • Instruction ID: 7eca73ef083414e2f1ff1c37baed5e155c8722cf5af3c84947dddb3c40e48584
                                                                • Opcode Fuzzy Hash: c7acee2708559ba9e82776faf72953a4b617b977718f8ff3e1fb042fff1953e6
                                                                • Instruction Fuzzy Hash: 77317275D00149EFCB04DFA9C885CAEB7F9FF49304B54806AE415E7251DB359E45CBA0
                                                                Function 007DDF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00777620: _wcslen.LIBCMT ref: 00777625
                                                                • _wcslen.LIBCMT ref: 007DDFCB
                                                                • _wcslen.LIBCMT ref: 007DDFE2
                                                                • _wcslen.LIBCMT ref: 007DE00D
                                                                • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 007DE018
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$ExtentPoint32Text
                                                                • String ID:
                                                                • API String ID: 3763101759-0
                                                                • Opcode ID: 5515938e61be6a5ddf3a03c3825a330acba3efbd4721449eb061ddd59a8b35ac
                                                                • Instruction ID: 9a3cd19358fe63759a2aaba1e99da8def491a675f45c1d2d80be913015f16277
                                                                • Opcode Fuzzy Hash: 5515938e61be6a5ddf3a03c3825a330acba3efbd4721449eb061ddd59a8b35ac
                                                                • Instruction Fuzzy Hash: 9E21E571900614EFCB21EFA8D881BAEB7F8EF45760F144065E904FB341D6789E41CBA1
                                                                Function 00808FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                • GetCursorPos.USER32(?), ref: 00809001
                                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,007C7711,?,?,?,?,?), ref: 00809016
                                                                • GetCursorPos.USER32(?), ref: 0080905E
                                                                • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,007C7711,?,?,?), ref: 00809094
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                • String ID:
                                                                • API String ID: 2864067406-0
                                                                • Opcode ID: 2769794dffc53b3fafb71ca0b9dad6c739adfd92a065fda3434dd0bd37a2c7e1
                                                                • Instruction ID: 77ad3fe15bb6e10c9b94e369ec6d49fbccb3dd7268a975fb801e93349e12c642
                                                                • Opcode Fuzzy Hash: 2769794dffc53b3fafb71ca0b9dad6c739adfd92a065fda3434dd0bd37a2c7e1
                                                                • Instruction Fuzzy Hash: 4B218D35600418EFDB658F94CC58EFA7BF9FF8A350F044165F985872A2C3319990DB60
                                                                Function 007DD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetFileAttributesW.KERNEL32(?,0080CB68), ref: 007DD2FB
                                                                • GetLastError.KERNEL32 ref: 007DD30A
                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 007DD319
                                                                • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0080CB68), ref: 007DD376
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateDirectory$AttributesErrorFileLast
                                                                • String ID:
                                                                • API String ID: 2267087916-0
                                                                • Opcode ID: 377a41afe74972e02ec3ebf91708f01e4b7f8e6dfa8f53c7ffdd9f94986efc6f
                                                                • Instruction ID: 4c9185c486bc9c52889fabd2201e625d9032735ab9cea249a3020dc82799c64d
                                                                • Opcode Fuzzy Hash: 377a41afe74972e02ec3ebf91708f01e4b7f8e6dfa8f53c7ffdd9f94986efc6f
                                                                • Instruction Fuzzy Hash: 5F212C70509201DFC720DF28C88586AB7F4BE56764F504A1EF4A9C73A1E7399D45CB93
                                                                Function 007D1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 007D102A
                                                                  • Part of subcall function 007D1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 007D1036
                                                                  • Part of subcall function 007D1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007D1045
                                                                  • Part of subcall function 007D1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 007D104C
                                                                  • Part of subcall function 007D1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007D1062
                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 007D15BE
                                                                • _memcmp.LIBVCRUNTIME ref: 007D15E1
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 007D1617
                                                                • HeapFree.KERNEL32(00000000), ref: 007D161E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                                • String ID:
                                                                • API String ID: 1592001646-0
                                                                • Opcode ID: af79e0ec83e484cf302236d89175e2079c7f26813f053de79b636362d3b0fac4
                                                                • Instruction ID: f74a59c2a75f3e99eef4c9c6fd7a550fe410d24268c453be236412528e4a50f5
                                                                • Opcode Fuzzy Hash: af79e0ec83e484cf302236d89175e2079c7f26813f053de79b636362d3b0fac4
                                                                • Instruction Fuzzy Hash: 41218971E00109FFDF00DFA4C949BEEB7B8EF44344F49855AE441AB241EB38AA45CBA0
                                                                Function 00802782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowLongW.USER32(?,000000EC), ref: 0080280A
                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00802824
                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00802832
                                                                • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00802840
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Long$AttributesLayered
                                                                • String ID:
                                                                • API String ID: 2169480361-0
                                                                • Opcode ID: 1790732d1881f2ea94fc85e72c455e0f276fc51781d44ab72f83e30364a62d3b
                                                                • Instruction ID: d098bae7fe97fc10a4d46230e2cf1c484fdb4d199514f498f2299dff3af00214
                                                                • Opcode Fuzzy Hash: 1790732d1881f2ea94fc85e72c455e0f276fc51781d44ab72f83e30364a62d3b
                                                                • Instruction Fuzzy Hash: E221A435204515AFD7549B24CC49F6A7795FF46328F148258F426CB6E2CBB5FC42C790
                                                                Function 007D78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 007D8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,007D790A,?,000000FF,?,007D8754,00000000,?,0000001C,?,?), ref: 007D8D8C
                                                                  • Part of subcall function 007D8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 007D8DB2
                                                                  • Part of subcall function 007D8D7D: lstrcmpiW.KERNEL32(00000000,?,007D790A,?,000000FF,?,007D8754,00000000,?,0000001C,?,?), ref: 007D8DE3
                                                                • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,007D8754,00000000,?,0000001C,?,?,00000000), ref: 007D7923
                                                                • lstrcpyW.KERNEL32(00000000,?), ref: 007D7949
                                                                • lstrcmpiW.KERNEL32(00000002,cdecl,?,007D8754,00000000,?,0000001C,?,?,00000000), ref: 007D7984
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: lstrcmpilstrcpylstrlen
                                                                • String ID: cdecl
                                                                • API String ID: 4031866154-3896280584
                                                                • Opcode ID: 86021a88f1c8abb12f9edc33dde51d9fdfae786923ea4dd4c0a7ea0cc34e3f7f
                                                                • Instruction ID: c526d68fcae3748820a94acd31f9c1cb5627b3c4cc183287077d2bd15352f552
                                                                • Opcode Fuzzy Hash: 86021a88f1c8abb12f9edc33dde51d9fdfae786923ea4dd4c0a7ea0cc34e3f7f
                                                                • Instruction Fuzzy Hash: B011B43A200201ABCB195F34D855D7A77B9FF89350B50402BE946C73A4FB359811C7A1
                                                                Function 00807CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00807D0B
                                                                • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00807D2A
                                                                • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00807D42
                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,007EB7AD,00000000), ref: 00807D6B
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Long
                                                                • String ID:
                                                                • API String ID: 847901565-0
                                                                • Opcode ID: 8b528419a8ee59db83a8b91a8425704ad36e4eba3a267cb833268c14413fb42a
                                                                • Instruction ID: 7ea2c8f818c746399b77b94d03c48b303d80beb5e8506e8fa7f7aca9bcbfa0b8
                                                                • Opcode Fuzzy Hash: 8b528419a8ee59db83a8b91a8425704ad36e4eba3a267cb833268c14413fb42a
                                                                • Instruction Fuzzy Hash: 1E11AF36A05619AFDB509F28CC08AA63BA5FF46360B254728FD39C72F0E731E950CB50
                                                                Function 00805660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,00001060,?,00000004), ref: 008056BB
                                                                • _wcslen.LIBCMT ref: 008056CD
                                                                • _wcslen.LIBCMT ref: 008056D8
                                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00805816
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend_wcslen
                                                                • String ID:
                                                                • API String ID: 455545452-0
                                                                • Opcode ID: 5a3a4c9c1b1822017b9a5c336ffbc0b683a1d743d56cf920af7e7b906536e722
                                                                • Instruction ID: cbe1da78947aeca8b17507c54ecd5e17db6e2d68545542376cbc92bbbb76b5b4
                                                                • Opcode Fuzzy Hash: 5a3a4c9c1b1822017b9a5c336ffbc0b683a1d743d56cf920af7e7b906536e722
                                                                • Instruction Fuzzy Hash: 5611E175A01A08A6DF609F61DC85AEF3BACFF10764B10402AF925E60C1EB709A81CF74
                                                                Function 007A1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6210792da8b5870a9b4d1af539a195fbf4f22b2fe077b37c1e766781764b0641
                                                                • Instruction ID: 5cef0db3b070700940b66f9be64bb7783ace7cdfd66e2072337b474a39dd3e68
                                                                • Opcode Fuzzy Hash: 6210792da8b5870a9b4d1af539a195fbf4f22b2fe077b37c1e766781764b0641
                                                                • Instruction Fuzzy Hash: 3C01ADB230961A7EF7612A786CC4F27661CEFC37B8F710329F521A11D2DB689C005A70
                                                                Function 007D1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 007D1A47
                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 007D1A59
                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 007D1A6F
                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 007D1A8A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend
                                                                • String ID:
                                                                • API String ID: 3850602802-0
                                                                • Opcode ID: bffcb0faafecd736b3630fead13ee3203fe57cee37e5b50c732feaf0abaddfb5
                                                                • Instruction ID: f699dc44a7cdf21d286b0c310b17682cfe1d8ba3f00003d146db5f1dccdf661e
                                                                • Opcode Fuzzy Hash: bffcb0faafecd736b3630fead13ee3203fe57cee37e5b50c732feaf0abaddfb5
                                                                • Instruction Fuzzy Hash: 4611393AD01219FFEB10DBA4CD85FADBB78FB08750F604092EA00B7290D6716E50DB94
                                                                Function 007DE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentThreadId.KERNEL32 ref: 007DE1FD
                                                                • MessageBoxW.USER32(?,?,?,?), ref: 007DE230
                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 007DE246
                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 007DE24D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                • String ID:
                                                                • API String ID: 2880819207-0
                                                                • Opcode ID: 1465262b10ab14b7886b63a7b544581df0bd495d1637255afcea2882ca713f4a
                                                                • Instruction ID: 7deac11d109737275a885c6beb10187e1560008676be674260e06c55309b6e54
                                                                • Opcode Fuzzy Hash: 1465262b10ab14b7886b63a7b544581df0bd495d1637255afcea2882ca713f4a
                                                                • Instruction Fuzzy Hash: 9C11DB76904254BBCB02AFA89C09A9F7FBCBB45314F14435AF914D7391D778DD0487A0
                                                                Function 0079D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateThread.KERNEL32(00000000,?,0079CFF9,00000000,00000004,00000000), ref: 0079D218
                                                                • GetLastError.KERNEL32 ref: 0079D224
                                                                • __dosmaperr.LIBCMT ref: 0079D22B
                                                                • ResumeThread.KERNEL32(00000000), ref: 0079D249
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                                • String ID:
                                                                • API String ID: 173952441-0
                                                                • Opcode ID: bca4a690b8012df784ddbfc0d49a897d9dda7919e0d874b4ec21e62e2a7313e7
                                                                • Instruction ID: 3bbf8b79b413ee3e9aeaa91c7b6248db616108afe2d77890f0bed574df1b7ab1
                                                                • Opcode Fuzzy Hash: bca4a690b8012df784ddbfc0d49a897d9dda7919e0d874b4ec21e62e2a7313e7
                                                                • Instruction Fuzzy Hash: 8201D236805208BBDF215FA9EC0ABAE7A69FF81730F210319F925921D0DB78CD01C6A0
                                                                Function 00809EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00789BB2
                                                                • GetClientRect.USER32(?,?), ref: 00809F31
                                                                • GetCursorPos.USER32(?), ref: 00809F3B
                                                                • ScreenToClient.USER32(?,?), ref: 00809F46
                                                                • DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00809F7A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Client$CursorLongProcRectScreenWindow
                                                                • String ID:
                                                                • API String ID: 4127811313-0
                                                                • Opcode ID: 2ed8634178a7a647a26d61dd8913d5d5cb546f6c0a3cfb08d3823f165853e084
                                                                • Instruction ID: 574c0cbacd6a091f67c621ba783ff2e579fdf87b3cbaade13f5986c0db10a7f6
                                                                • Opcode Fuzzy Hash: 2ed8634178a7a647a26d61dd8913d5d5cb546f6c0a3cfb08d3823f165853e084
                                                                • Instruction Fuzzy Hash: 62114836A0011AABDB50EFA8DC899EE7BB8FB05311F000555F951E3191DB30BA81CBA1
                                                                Function 0077600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0077604C
                                                                • GetStockObject.GDI32(00000011), ref: 00776060
                                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 0077606A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateMessageObjectSendStockWindow
                                                                • String ID:
                                                                • API String ID: 3970641297-0
                                                                • Opcode ID: f34d8e88813b17180b736e873a6663dd5e4f2bc85e1fd0df1e31e72c121bcf0f
                                                                • Instruction ID: 0248df80b020764f7725ee21478ba36a0c4eac54f6c6c1875f2f1324fdddc2f9
                                                                • Opcode Fuzzy Hash: f34d8e88813b17180b736e873a6663dd5e4f2bc85e1fd0df1e31e72c121bcf0f
                                                                • Instruction Fuzzy Hash: 52118B72101908BFEF524FA48C44EEABBA9FF083A4F004215FA1852010D7369C60DBA0
                                                                Function 00793B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • ___BuildCatchObject.LIBVCRUNTIME ref: 00793B56
                                                                  • Part of subcall function 00793AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00793AD2
                                                                  • Part of subcall function 00793AA3: ___AdjustPointer.LIBCMT ref: 00793AED
                                                                • _UnwindNestedFrames.LIBCMT ref: 00793B6B
                                                                • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00793B7C
                                                                • CallCatchBlock.LIBVCRUNTIME ref: 00793BA4
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                                • String ID:
                                                                • API String ID: 737400349-0
                                                                • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                • Instruction ID: 383071d3fcc70673cc667c72a1e9584731eeb3431f07ad48e9f5b0ddc1349cbc
                                                                • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                • Instruction Fuzzy Hash: C9012972100148BBDF126E95EC46EEB3B7AFF48754F044014FE4896121C73AE962EBA0
                                                                Function 007A3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,007713C6,00000000,00000000,?,007A301A,007713C6,00000000,00000000,00000000,?,007A328B,00000006,FlsSetValue), ref: 007A30A5
                                                                • GetLastError.KERNEL32(?,007A301A,007713C6,00000000,00000000,00000000,?,007A328B,00000006,FlsSetValue,00812290,FlsSetValue,00000000,00000364,?,007A2E46), ref: 007A30B1
                                                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,007A301A,007713C6,00000000,00000000,00000000,?,007A328B,00000006,FlsSetValue,00812290,FlsSetValue,00000000), ref: 007A30BF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: LibraryLoad$ErrorLast
                                                                • String ID:
                                                                • API String ID: 3177248105-0
                                                                • Opcode ID: 902c6b4ab9e1e4fdfbe25047f7e58b1e81746282da49781fac2231fde6f9db04
                                                                • Instruction ID: a3de40865cfd80ea95e89d87575cf0f6419fa26452626a2f09c8b117ea2237e5
                                                                • Opcode Fuzzy Hash: 902c6b4ab9e1e4fdfbe25047f7e58b1e81746282da49781fac2231fde6f9db04
                                                                • Instruction Fuzzy Hash: E1012B32312226EBCB314F799C489577B9ABF87BA1B210720F905E3180D725D901C6E0
                                                                Function 007D7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 007D747F
                                                                • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 007D7497
                                                                • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007D74AC
                                                                • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 007D74CA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Type$Register$FileLoadModuleNameUser
                                                                • String ID:
                                                                • API String ID: 1352324309-0
                                                                • Opcode ID: 8e4208c2f9598f6993662d9f4b5e90b899917745b0374a5dbf58c5647fd83551
                                                                • Instruction ID: 23412410464edd4d9eb99374a9c72e305a20fe77339e13f6bb3dee733a5984c1
                                                                • Opcode Fuzzy Hash: 8e4208c2f9598f6993662d9f4b5e90b899917745b0374a5dbf58c5647fd83551
                                                                • Instruction Fuzzy Hash: F811C0B1205750AFE7218F14DC09F92BFFCFB00B10F10856AA616D6291E7B4E904DBA0
                                                                Function 007DB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,007DACD3,?,00008000), ref: 007DB0C4
                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,007DACD3,?,00008000), ref: 007DB0E9
                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,007DACD3,?,00008000), ref: 007DB0F3
                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,007DACD3,?,00008000), ref: 007DB126
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CounterPerformanceQuerySleep
                                                                • String ID:
                                                                • API String ID: 2875609808-0
                                                                • Opcode ID: e7c8fc3d6696a5cd7b4cdc494ce4300c07e928b837555a880e54ac106919d8b4
                                                                • Instruction ID: c65266b20c10ae5227cde947923553f2cb2d064039fad454f61b4783133a4f32
                                                                • Opcode Fuzzy Hash: e7c8fc3d6696a5cd7b4cdc494ce4300c07e928b837555a880e54ac106919d8b4
                                                                • Instruction Fuzzy Hash: BB118031D0162CE7CF00AFE4E9596EEBF78FF49711F124186D941B2281CB389650CB95
                                                                Function 00807E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowRect.USER32(?,?), ref: 00807E33
                                                                • ScreenToClient.USER32(?,?), ref: 00807E4B
                                                                • ScreenToClient.USER32(?,?), ref: 00807E6F
                                                                • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00807E8A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClientRectScreen$InvalidateWindow
                                                                • String ID:
                                                                • API String ID: 357397906-0
                                                                • Opcode ID: 0dbc6fc0bd4d690d583435497b4132498939a89fded29eddcaa7aa9408236b29
                                                                • Instruction ID: 040e846bba67442f3fc40018eaf43de4cd0cf2234c372cd1ab802539dae5b199
                                                                • Opcode Fuzzy Hash: 0dbc6fc0bd4d690d583435497b4132498939a89fded29eddcaa7aa9408236b29
                                                                • Instruction Fuzzy Hash: F81186B9D0020AAFDB41CF98C8849EEBBF5FF08310F104156E911E3250D735AA54CF50
                                                                Function 007D2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 007D2DC5
                                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 007D2DD6
                                                                • GetCurrentThreadId.KERNEL32 ref: 007D2DDD
                                                                • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 007D2DE4
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                • String ID:
                                                                • API String ID: 2710830443-0
                                                                • Opcode ID: 1398047e3f02cc5de1ddd3b7621d4c67b542f2b6eead57455dda02c7e61a00c4
                                                                • Instruction ID: 51d9d4214ed33a003631198750aa795121a672fa5f11d37450ac3b378c0b111c
                                                                • Opcode Fuzzy Hash: 1398047e3f02cc5de1ddd3b7621d4c67b542f2b6eead57455dda02c7e61a00c4
                                                                • Instruction Fuzzy Hash: 78E06DB12012247AD7201B629C0DEEB3E6DFF66BA1F04021AB106D11919AA58842C6B0
                                                                Function 00808863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00789639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00789693
                                                                  • Part of subcall function 00789639: SelectObject.GDI32(?,00000000), ref: 007896A2
                                                                  • Part of subcall function 00789639: BeginPath.GDI32(?), ref: 007896B9
                                                                  • Part of subcall function 00789639: SelectObject.GDI32(?,00000000), ref: 007896E2
                                                                • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00808887
                                                                • LineTo.GDI32(?,?,?), ref: 00808894
                                                                • EndPath.GDI32(?), ref: 008088A4
                                                                • StrokePath.GDI32(?), ref: 008088B2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                • String ID:
                                                                • API String ID: 1539411459-0
                                                                • Opcode ID: 0055dd72edc52dcc40af6711a3811359a1dabf0da2651ba81a15861d03c27d34
                                                                • Instruction ID: 47d2de15ce7471260a298f89b188d4d27175e3c9fdc110e576433d91a8f32307
                                                                • Opcode Fuzzy Hash: 0055dd72edc52dcc40af6711a3811359a1dabf0da2651ba81a15861d03c27d34
                                                                • Instruction Fuzzy Hash: 73F03A36041658FAEB526F94AC0DFCA3E59BF06310F448100FA11650E1C7755551DBE5
                                                                Function 007898B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetSysColor.USER32(00000008), ref: 007898CC
                                                                • SetTextColor.GDI32(?,?), ref: 007898D6
                                                                • SetBkMode.GDI32(?,00000001), ref: 007898E9
                                                                • GetStockObject.GDI32(00000005), ref: 007898F1
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Color$ModeObjectStockText
                                                                • String ID:
                                                                • API String ID: 4037423528-0
                                                                • Opcode ID: ef81faa0006920580f5178e2987dcffc84ca86c936440e391a21feb6ebfcd4dc
                                                                • Instruction ID: f5b10391d63bbfb99c21d0b4068fc60d7b943f66ea24b73dfaad8282ffee4990
                                                                • Opcode Fuzzy Hash: ef81faa0006920580f5178e2987dcffc84ca86c936440e391a21feb6ebfcd4dc
                                                                • Instruction Fuzzy Hash: F3E03931284280AEDB615F74AC09BE83B20BB12336F048319FABA580E1C77586509B10
                                                                Function 007D162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentThread.KERNEL32 ref: 007D1634
                                                                • OpenThreadToken.ADVAPI32(00000000,?,?,?,007D11D9), ref: 007D163B
                                                                • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007D11D9), ref: 007D1648
                                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,007D11D9), ref: 007D164F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CurrentOpenProcessThreadToken
                                                                • String ID:
                                                                • API String ID: 3974789173-0
                                                                • Opcode ID: f8386d9fa90ff20a6be7216c47664422d8d3731e5f1c16e54746b726f2a44a0a
                                                                • Instruction ID: aacd97fcf5e26aac645f2f663d65bc0890f8e48667e1eb9be5e498bc509de6d2
                                                                • Opcode Fuzzy Hash: f8386d9fa90ff20a6be7216c47664422d8d3731e5f1c16e54746b726f2a44a0a
                                                                • Instruction Fuzzy Hash: F4E08C32602211EBE7A01FA1AE0EB863B7CBF44792F148909F245C9090EA388440CB60
                                                                Function 007CD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDesktopWindow.USER32 ref: 007CD858
                                                                • GetDC.USER32(00000000), ref: 007CD862
                                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 007CD882
                                                                • ReleaseDC.USER32(?), ref: 007CD8A3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                • String ID:
                                                                • API String ID: 2889604237-0
                                                                • Opcode ID: 080563d57fded2f246d5f61d6b6d66e4396fee68d5a1daa5af75a605e126cf8d
                                                                • Instruction ID: 8b009cba28993463e46b6d6a55298c1be636e08ce2bcbfbebde5ff193c77ee90
                                                                • Opcode Fuzzy Hash: 080563d57fded2f246d5f61d6b6d66e4396fee68d5a1daa5af75a605e126cf8d
                                                                • Instruction Fuzzy Hash: C1E01AB1800204DFCFA1AFA0D80CA6DBBB1FB18310F14811DF856E7250CB398941AF50
                                                                Function 007CD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDesktopWindow.USER32 ref: 007CD86C
                                                                • GetDC.USER32(00000000), ref: 007CD876
                                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 007CD882
                                                                • ReleaseDC.USER32(?), ref: 007CD8A3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                • String ID:
                                                                • API String ID: 2889604237-0
                                                                • Opcode ID: f5e9466d73020aae2f6b141506d0c9297b4e8c4d84dd585580bf9d9e69b6a856
                                                                • Instruction ID: 9ba44e664bcb2e2a6f09ffeb85be6d951c295636ba764b4e94992540813502d2
                                                                • Opcode Fuzzy Hash: f5e9466d73020aae2f6b141506d0c9297b4e8c4d84dd585580bf9d9e69b6a856
                                                                • Instruction Fuzzy Hash: E9E092B5800204EFCFA1AFA0D80D66DBBB5BB18311F149549E95AE7290DB395901AF50
                                                                Function 007E4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00777620: _wcslen.LIBCMT ref: 00777625
                                                                • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 007E4ED4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Connection_wcslen
                                                                • String ID: *$LPT
                                                                • API String ID: 1725874428-3443410124
                                                                • Opcode ID: 425e8eef9b13cdeb3872f68f08263c76aa204e0dea03e6a9b91a2576faa47dd2
                                                                • Instruction ID: f675f3aa1328dc75a278161a12f963d4ad639927757f7332d8c8bd1030dca1ca
                                                                • Opcode Fuzzy Hash: 425e8eef9b13cdeb3872f68f08263c76aa204e0dea03e6a9b91a2576faa47dd2
                                                                • Instruction Fuzzy Hash: 51917275A01244DFCB14DF59C484EAABBF1BF48704F198099E80A9F362D739ED85CB91
                                                                Function 0079E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __startOneArgErrorHandling.LIBCMT ref: 0079E30D
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorHandling__start
                                                                • String ID: pow
                                                                • API String ID: 3213639722-2276729525
                                                                • Opcode ID: 81b2b00e1d5ad39cdc6e34f07e1592458df3d510beae3b37a9d64c918b735709
                                                                • Instruction ID: ff58a0e11264b6ff1bc9e55087c8c01a2a03aa5540d167971e18ac335597196b
                                                                • Opcode Fuzzy Hash: 81b2b00e1d5ad39cdc6e34f07e1592458df3d510beae3b37a9d64c918b735709
                                                                • Instruction Fuzzy Hash: D3513B61A0D20296CF19B714ED453B93BA8FF81741F348E68F0D5422A9EF3D8C91DA46
                                                                Function 0078E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: #
                                                                • API String ID: 0-1885708031
                                                                • Opcode ID: fb210a7ed5ef153b6b531eac63a4a1e3a634e1689189d3035951e9fdaea60170
                                                                • Instruction ID: b9595e822b2b7366c02da1ebfb42c51cf8b7af19886acbaf9e7b2d0a12e9157b
                                                                • Opcode Fuzzy Hash: fb210a7ed5ef153b6b531eac63a4a1e3a634e1689189d3035951e9fdaea60170
                                                                • Instruction Fuzzy Hash: 3D51F075904246DFDF25EF68C485ABA7BA8FF25310F24805DE8919B290DB3C9D42CBA0
                                                                Function 0078F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • Sleep.KERNEL32(00000000), ref: 0078F2A2
                                                                • GlobalMemoryStatusEx.KERNEL32(?), ref: 0078F2BB
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: GlobalMemorySleepStatus
                                                                • String ID: @
                                                                • API String ID: 2783356886-2766056989
                                                                • Opcode ID: a29dbaa1cd85e2da58b9265bbd44a76688e0eb9275f737b479bf09f38d9273f8
                                                                • Instruction ID: 937692c531b29f070d7835edec8fe0869fe5482c99c3302a7ead33c0d30e08e2
                                                                • Opcode Fuzzy Hash: a29dbaa1cd85e2da58b9265bbd44a76688e0eb9275f737b479bf09f38d9273f8
                                                                • Instruction Fuzzy Hash: 59514672418744DBD720AF20DC8ABAFBBF8FB95340F81885DF1D9411A5EB348529CB66
                                                                Function 007F5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 007F57E0
                                                                • _wcslen.LIBCMT ref: 007F57EC
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: BuffCharUpper_wcslen
                                                                • String ID: CALLARGARRAY
                                                                • API String ID: 157775604-1150593374
                                                                • Opcode ID: 3c3d1b757980f26a85c49dfc732560337943924d54eef5d028621bc029649c61
                                                                • Instruction ID: 6f25f9d434c0a0b8da3fa77633c3de4f49d5f7c4b87d357e387073603120b876
                                                                • Opcode Fuzzy Hash: 3c3d1b757980f26a85c49dfc732560337943924d54eef5d028621bc029649c61
                                                                • Instruction Fuzzy Hash: 7541A131A00209DFCF14EFA9C8868BEBBB5FF59360F104169E605A7391E7389D81CB90
                                                                Function 007ED0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _wcslen.LIBCMT ref: 007ED130
                                                                • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 007ED13A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CrackInternet_wcslen
                                                                • String ID: |
                                                                • API String ID: 596671847-2343686810
                                                                • Opcode ID: 3784cb88800ef61589adfa9d8fd5cd544fb28c07fb236916acb088c0c99cd229
                                                                • Instruction ID: 01385c66f79635dcecaac5b42c06df5e9132ec08fd36b3d69acc41e068b710e3
                                                                • Opcode Fuzzy Hash: 3784cb88800ef61589adfa9d8fd5cd544fb28c07fb236916acb088c0c99cd229
                                                                • Instruction Fuzzy Hash: 54312D71D01209EBCF15EFA5CC89AEE7FB9FF08340F004019F919A6165E775A916CB61
                                                                Function 0080356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DestroyWindow.USER32(?,?,?,?), ref: 00803621
                                                                • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0080365C
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$DestroyMove
                                                                • String ID: static
                                                                • API String ID: 2139405536-2160076837
                                                                • Opcode ID: 292c504f665bec22fe80a36f664cc83e3ae0e82eb1f576a14254b19ea7881a92
                                                                • Instruction ID: 369dd3f6866f49af6a593a568a99bcca856ee98ea16e5bc642d4683e66f58cb2
                                                                • Opcode Fuzzy Hash: 292c504f665bec22fe80a36f664cc83e3ae0e82eb1f576a14254b19ea7881a92
                                                                • Instruction Fuzzy Hash: F331AB71100608AAEB609F28DC81EBB73ADFF98720F109619F8A5D7290DB35AD81D760
                                                                Function 00804537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0080461F
                                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00804634
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend
                                                                • String ID: '
                                                                • API String ID: 3850602802-1997036262
                                                                • Opcode ID: abe53eddfca44fb03342d9d3d5a5595afcd7cdc619393b44e2ae49e2d3b0a5db
                                                                • Instruction ID: 9db506ca04222c56296e73eb82a6b52940ad1e067dc08c937cb62d12f9ed5db0
                                                                • Opcode Fuzzy Hash: abe53eddfca44fb03342d9d3d5a5595afcd7cdc619393b44e2ae49e2d3b0a5db
                                                                • Instruction Fuzzy Hash: E0314AB5A4120A9FEF54CFA9C980BDA7BB5FF49300F105069EA14EB381E771A941CF90
                                                                Function 008031EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0080327C
                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00803287
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend
                                                                • String ID: Combobox
                                                                • API String ID: 3850602802-2096851135
                                                                • Opcode ID: a32f78ab1b61e580e2d9a522cee080a50ffd5ba75b563c4e07c61101474a63ab
                                                                • Instruction ID: a882a58fbbdc81c5b26d849ec035d567a625e05f762654d37d6868d049180607
                                                                • Opcode Fuzzy Hash: a32f78ab1b61e580e2d9a522cee080a50ffd5ba75b563c4e07c61101474a63ab
                                                                • Instruction Fuzzy Hash: D9118E71200208AFEFA19E54DC85EAB376EFB943A5F104129F928D72D0D6319D518760
                                                                Function 00803710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 0077600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0077604C
                                                                  • Part of subcall function 0077600E: GetStockObject.GDI32(00000011), ref: 00776060
                                                                  • Part of subcall function 0077600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0077606A
                                                                • GetWindowRect.USER32(00000000,?), ref: 0080377A
                                                                • GetSysColor.USER32(00000012), ref: 00803794
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                • String ID: static
                                                                • API String ID: 1983116058-2160076837
                                                                • Opcode ID: c727d15430dacb6cf5adef2cbb7aaaa80446e40316cade932190d81c751efc88
                                                                • Instruction ID: 58e6350d12b6d1464b506f8ebcdf70dd2df02d010d161f73a145701afa4e90bd
                                                                • Opcode Fuzzy Hash: c727d15430dacb6cf5adef2cbb7aaaa80446e40316cade932190d81c751efc88
                                                                • Instruction Fuzzy Hash: A31129B2610209AFDF50DFA8CC45EFA7BB8FB08354F004A25F955E2290E735E851DB50
                                                                Function 007ECD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 007ECD7D
                                                                • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 007ECDA6
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Internet$OpenOption
                                                                • String ID: <local>
                                                                • API String ID: 942729171-4266983199
                                                                • Opcode ID: da96a56702c037ab4bf5fe84e2fafd6fa7bae13b832c0b253471e4c88d3f2ffe
                                                                • Instruction ID: a4e46c32f1aa4a16b3839e9d23d2b6c63df38eba2c8ab353ae3fb634e445e273
                                                                • Opcode Fuzzy Hash: da96a56702c037ab4bf5fe84e2fafd6fa7bae13b832c0b253471e4c88d3f2ffe
                                                                • Instruction Fuzzy Hash: FD11C679306671BAD7758B678C45EE7BEACEF167A4F004226B10983180D7799842D6F0
                                                                Function 00803429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowTextLengthW.USER32(00000000), ref: 008034AB
                                                                • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 008034BA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: LengthMessageSendTextWindow
                                                                • String ID: edit
                                                                • API String ID: 2978978980-2167791130
                                                                • Opcode ID: 5e546a4ffa50fd3e7faf06c50dbab3d0772ecd0297d039afcb46979364443f60
                                                                • Instruction ID: 50b9080ef1e40375910d34f0ed4d047fa8f5461ce23148d7bb55052ae65bc633
                                                                • Opcode Fuzzy Hash: 5e546a4ffa50fd3e7faf06c50dbab3d0772ecd0297d039afcb46979364443f60
                                                                • Instruction Fuzzy Hash: 47119D71100508AAEB914F64DC44AAA376EFB25378F504324F960DB1E0C771DD919758
                                                                Function 007D6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                • CharUpperBuffW.USER32(?,?,?), ref: 007D6CB6
                                                                • _wcslen.LIBCMT ref: 007D6CC2
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharUpper
                                                                • String ID: STOP
                                                                • API String ID: 1256254125-2411985666
                                                                • Opcode ID: 355be675ca26fe8b17a0def58e46884034b3166ac5e0710d206b7c471c6e1fdc
                                                                • Instruction ID: 3d1db5ed0d6494b46c0fead108c20addb26eb5ec73163ff982e182c0e5b2136e
                                                                • Opcode Fuzzy Hash: 355be675ca26fe8b17a0def58e46884034b3166ac5e0710d206b7c471c6e1fdc
                                                                • Instruction Fuzzy Hash: AF0104326105268ACF20AFBDDC858BF73B5FB61750700052AE86692291EA39E800C660
                                                                Function 007D1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 007D3CCA
                                                                • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 007D1D4C
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameSend_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 624084870-1403004172
                                                                • Opcode ID: 97268965c6c8feb0fd3bf20ae25eb1e33fdabd31de5060eb2bdd6bd7aa327d6c
                                                                • Instruction ID: ad404057d2978835f680a02d715a7da0f3904f13b2e425a251696704437e79a1
                                                                • Opcode Fuzzy Hash: 97268965c6c8feb0fd3bf20ae25eb1e33fdabd31de5060eb2bdd6bd7aa327d6c
                                                                • Instruction Fuzzy Hash: 5B01B571711218ABCF14EBA4CD55CFEB379FB56390B440A1AE836673C1EB3959088671
                                                                Function 007D1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 007D3CCA
                                                                • SendMessageW.USER32(?,00000180,00000000,?), ref: 007D1C46
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameSend_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 624084870-1403004172
                                                                • Opcode ID: 9331ffb5eed01e0b69bd252925e39f96db6f67104af652d844f78375657c128c
                                                                • Instruction ID: 389e5aaf2b61daf3e3fbc597810c7394418ea2ca395eaf6ece0989532b6e5f29
                                                                • Opcode Fuzzy Hash: 9331ffb5eed01e0b69bd252925e39f96db6f67104af652d844f78375657c128c
                                                                • Instruction Fuzzy Hash: E701A775791104B6DF14EBA0CE56DFFB7B89B52380F54001AA51E773C2EA289E0886B2
                                                                Function 007D1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 007D3CCA
                                                                • SendMessageW.USER32(?,00000182,?,00000000), ref: 007D1CC8
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameSend_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 624084870-1403004172
                                                                • Opcode ID: c2bff91e323ed69cd91931ada67bd6b989094afedc8f2b68c2b6ea3b96aa9163
                                                                • Instruction ID: 0cb0c791f62759e021fa544fb8544bc7a76cf68b6b2a8c794cf2cfb4046166b0
                                                                • Opcode Fuzzy Hash: c2bff91e323ed69cd91931ada67bd6b989094afedc8f2b68c2b6ea3b96aa9163
                                                                • Instruction Fuzzy Hash: AC01A771751114B6CF14EBA0CA06EFEB3B8AB11380F540016B91973381EA299F08C672
                                                                Function 007D1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00779CB3: _wcslen.LIBCMT ref: 00779CBD
                                                                  • Part of subcall function 007D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 007D3CCA
                                                                • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 007D1DD3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameSend_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 624084870-1403004172
                                                                • Opcode ID: eb7f64afb40fedd5e3d7bc2e525f1334f36d972d7743b98ab158eff6ba444d62
                                                                • Instruction ID: 4b1a29a819100f8550664655791c351bdc349a029aa55e6a4e1d367209117628
                                                                • Opcode Fuzzy Hash: eb7f64afb40fedd5e3d7bc2e525f1334f36d972d7743b98ab158eff6ba444d62
                                                                • Instruction Fuzzy Hash: D4F0F471B52214B6CF04E7A4CD56EFEB378AB12390F44091AB936A33C1DB68590882B1
                                                                Function 007F747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen
                                                                • String ID: 3, 3, 16, 1
                                                                • API String ID: 176396367-3042988571
                                                                • Opcode ID: a6f7f2e4f0788bdd74af2540e5965a9cc982e0e71317a3e8d5989bf7760d9b87
                                                                • Instruction ID: cf653e205d23cc930a38400a9a5382069feeace3c1bc8daf9442b983058cf3e3
                                                                • Opcode Fuzzy Hash: a6f7f2e4f0788bdd74af2540e5965a9cc982e0e71317a3e8d5989bf7760d9b87
                                                                • Instruction Fuzzy Hash: 9BE02B52204664609235227DACC5D7F5689DFC9760710182BFA81C2366EA9CDD92D3A0
                                                                Function 007D0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 007D0B23
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Message
                                                                • String ID: AutoIt$Error allocating memory.
                                                                • API String ID: 2030045667-4017498283
                                                                • Opcode ID: 3a6faf75849c76c4eb778ebd1c0b09b9b03f2ad4ca18a82de99b99cab89e5a5d
                                                                • Instruction ID: 123e13791d114269a8eea5717b36dc78a6e81a86bac9bfa33ace32071d2306ec
                                                                • Opcode Fuzzy Hash: 3a6faf75849c76c4eb778ebd1c0b09b9b03f2ad4ca18a82de99b99cab89e5a5d
                                                                • Instruction Fuzzy Hash: 5BE0D831284308A6D6143B947C0BF897B84DF05B61F100427FB58956C38AE9249006E9
                                                                Function 00790D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 0078F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00790D71,?,?,?,0077100A), ref: 0078F7CE
                                                                • IsDebuggerPresent.KERNEL32(?,?,?,0077100A), ref: 00790D75
                                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0077100A), ref: 00790D84
                                                                Strings
                                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00790D7F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                • API String ID: 55579361-631824599
                                                                • Opcode ID: f8ac2c2bf096774bdf573a0b76f991a37fc801e47168bf9cf7600dd0a385d76f
                                                                • Instruction ID: c8c6ab4ecafa1072893424ecaf2608abaef755f4d3bccac7662d27370e8b7c3c
                                                                • Opcode Fuzzy Hash: f8ac2c2bf096774bdf573a0b76f991a37fc801e47168bf9cf7600dd0a385d76f
                                                                • Instruction Fuzzy Hash: 1DE0ED742007518FEBB09FB8E8487467BE4BB14754F008A2DE996C6A92DBB9E444CBD1
                                                                Function 007E3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 007E302F
                                                                • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 007E3044
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: Temp$FileNamePath
                                                                • String ID: aut
                                                                • API String ID: 3285503233-3010740371
                                                                • Opcode ID: 38effe4cbfe31e0a0f0e5116dd64f4d8d6e752dfed69f465688474c40a9c1c89
                                                                • Instruction ID: c0c34aab24ee5e003bd141fd2c06e20fc28f34c5ebf3d2dba5648e57dc8d2c7d
                                                                • Opcode Fuzzy Hash: 38effe4cbfe31e0a0f0e5116dd64f4d8d6e752dfed69f465688474c40a9c1c89
                                                                • Instruction Fuzzy Hash: 92D05E7250032877DA60ABA8AC0EFCB3B6CEB05750F0002A1B655E20D1EAB49984CAD0
                                                                Function 007CD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: LocalTime
                                                                • String ID: %.3d$X64
                                                                • API String ID: 481472006-1077770165
                                                                • Opcode ID: 13c5a909eae121d8a245ef754aa562430a3dd5854f77032c01eeb7ee3f44a092
                                                                • Instruction ID: 7ad0493857eb2b7378e96584b621496b5839d9b4c623cc14f63c64c7374a377b
                                                                • Opcode Fuzzy Hash: 13c5a909eae121d8a245ef754aa562430a3dd5854f77032c01eeb7ee3f44a092
                                                                • Instruction Fuzzy Hash: B8D012A1C48108E9CBB0A7E0CC49EBAB3BCFB09301F50847EF806D2040D63CCD486B61
                                                                Function 00802322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0080232C
                                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0080233F
                                                                  • Part of subcall function 007DE97B: Sleep.KERNEL32 ref: 007DE9F3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FindMessagePostSleepWindow
                                                                • String ID: Shell_TrayWnd
                                                                • API String ID: 529655941-2988720461
                                                                • Opcode ID: 8ffe0966762128bbcea2dcaf1b6e06b2758681732ebbbe7d24c78e1ba2e6046c
                                                                • Instruction ID: de3898598dd4fad9ec3133546fb9dc177223bd54a239f5a0eabd5aa1af535324
                                                                • Opcode Fuzzy Hash: 8ffe0966762128bbcea2dcaf1b6e06b2758681732ebbbe7d24c78e1ba2e6046c
                                                                • Instruction Fuzzy Hash: FFD0C976395310B6E6E8BB709C1FFC66A18BB50B14F108A167655AA2D0D9A4A8018A94
                                                                Function 00802356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0080236C
                                                                • PostMessageW.USER32(00000000), ref: 00802373
                                                                  • Part of subcall function 007DE97B: Sleep.KERNEL32 ref: 007DE9F3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: FindMessagePostSleepWindow
                                                                • String ID: Shell_TrayWnd
                                                                • API String ID: 529655941-2988720461
                                                                • Opcode ID: a9d7dee7963ff627b3f1c917933251882e52772baf18ed0fb0743cf039ed07a8
                                                                • Instruction ID: 5db35058612691e908305e3e9cc3af431ebffef696b2edf29fd67eb6bcb6aaaf
                                                                • Opcode Fuzzy Hash: a9d7dee7963ff627b3f1c917933251882e52772baf18ed0fb0743cf039ed07a8
                                                                • Instruction Fuzzy Hash: 2CD0C976382310BAE6E8BB709C0FFC66618BB55B14F508A167655EA2D0D9A4B8018A94
                                                                Function 007ABDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 007ABE93
                                                                • GetLastError.KERNEL32 ref: 007ABEA1
                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007ABEFC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.2001986061.0000000000771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true
                                                                • Associated: 00000000.00000002.2001967456.0000000000770000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002054204.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002106377.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.2002126455.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_770000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide$ErrorLast
                                                                • String ID:
                                                                • API String ID: 1717984340-0
                                                                • Opcode ID: 4e0f6b39c467c80c7aa5e77a63a0ce04e75892540421b84354a99f4768ef7373
                                                                • Instruction ID: db7c9c21422e587115a4439a61c6542057a954b8f106404c9aeefaf1a33f686e
                                                                • Opcode Fuzzy Hash: 4e0f6b39c467c80c7aa5e77a63a0ce04e75892540421b84354a99f4768ef7373
                                                                • Instruction Fuzzy Hash: C7412935605246EFCF218FA4DC94ABA7BA4EF83310F184369F959971A3DB348D00CB50

                                                                Execution Graph

                                                                Execution Coverage:0.3%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:100%
                                                                Total number of Nodes:6
                                                                Total number of Limit Nodes:0
                                                                execution_graph 5007 27d1bf18777 5008 27d1bf18787 NtQuerySystemInformation 5007->5008 5009 27d1bf18724 5008->5009 5010 27d1c37b432 5011 27d1c37b489 NtQuerySystemInformation 5010->5011 5012 27d1c379804 5010->5012 5011->5012

                                                                Callgraph

                                                                Executed Functions

                                                                Function 0000027D1BF18777 Relevance: 8.3, APIs: 1, Instructions: 6848nativeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000010.00000002.3258739369.0000027D1BF16000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000027D1BF16000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_16_2_27d1bf16000_firefox.jbxd
                                                                Similarity
                                                                • API ID: InformationQuerySystem
                                                                • String ID:
                                                                • API String ID: 3562636166-0
                                                                • Opcode ID: 7d855dfef058891d6d0f13281f0639ac0c732643bbd828a8aceaae6a46d64bc4
                                                                • Instruction ID: 00aba7f9dccbf9098a641f65d5eebd0a42e82a9a941afdf22357deaf8962627f
                                                                • Opcode Fuzzy Hash: 7d855dfef058891d6d0f13281f0639ac0c732643bbd828a8aceaae6a46d64bc4
                                                                • Instruction Fuzzy Hash: 68A3E071618A488BDB2DEF2CCC897A977F5FB95300F44562ED94FC7241DB31EA428A81