Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1502493
MD5:b129d4053a168a3d69fed0a5c1088353
SHA1:4e136ac4aad5dd4caec5b36436c9aa2ca0e46dbb
SHA256:c74e6420dd151177d9608cc9f7c4163cc86b1ed7e2a2655da309debd07d18e3e
Tags:exe
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Maps a DLL or memory area into another process
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B129D4053A168A3D69FED0A5C1088353)
    • msedge.exe (PID: 7300 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 7612 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2076,i,1828721353005406552,4286803318795052176,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • firefox.exe (PID: 7320 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • firefox.exe (PID: 7496 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 7584 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8604 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acc27241-3c31-435d-99e4-83922da2a76d} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b6bc6ed10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 7520 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4260 -parentBuildID 20230927232528 -prefsHandle 4620 -prefMapHandle 3896 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cd84140-ac0b-45b4-9542-7f422c07c9d5} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b78b57710 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 7280 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 33865 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e192372e-be7d-4bb5-b0f1-d46844c70d01} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b87784910 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • msedge.exe (PID: 7628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8376 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6360 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8400 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6556 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • identity_helper.exe (PID: 8924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6816 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • identity_helper.exe (PID: 8944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6816 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • msedge.exe (PID: 8224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6736 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 1608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 5436 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,12420635758166294745,5105143302083340951,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 9560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 9764 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1980,i,9697535281678700936,11038712812997427642,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: file.exeReversingLabs: Detection: 26%
Source: file.exeVirustotal: Detection: 25%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for sample
Source: file.exeJoe Sandbox ML: detected
Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.4:50438 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:50439 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:50440 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50442 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50441 version: TLS 1.2
Source: unknownHTTPS traffic detected: 18.65.39.112:443 -> 192.168.2.4:50444 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50447 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50448 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50449 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:50446 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50455 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50458 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50462 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50465 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50472 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50473 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50477 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50478 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50479 version: TLS 1.2
Source: Binary string: webauthn.pdb source: firefox.exe, 00000005.00000003.2181788280.0000021B8A241000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000005.00000003.2081900262.0000021B7C670000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.dr
Source: Binary string: wshbth.pdbGCTL source: firefox.exe, 00000005.00000003.2184689605.0000021B7B8BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NapiNSP.pdbUGP source: firefox.exe, 00000005.00000003.2184015694.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wshbth.pdb source: firefox.exe, 00000005.00000003.2184689605.0000021B7B8BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pnrpnsp.pdb source: firefox.exe, 00000005.00000003.2184398800.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NapiNSP.pdb source: firefox.exe, 00000005.00000003.2184015694.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000005.00000003.2081900262.0000021B7C670000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.dr
Source: Binary string: netprofm.pdb source: firefox.exe, 00000005.00000003.2182813988.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: webauthn.pdbGCTL source: firefox.exe, 00000005.00000003.2181788280.0000021B8A241000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pnrpnsp.pdbUGP source: firefox.exe, 00000005.00000003.2184398800.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: netprofm.pdbUGP source: firefox.exe, 00000005.00000003.2182813988.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_006BDBBE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C68EE FindFirstFileW,FindClose,0_2_006C68EE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_006C698F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_006BD076
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_006BD3A9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_006C9642
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_006C979D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_006C9B2B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_006C5C97
Source: firefox.exeMemory has grown: Private usage: 1MB later: 96MB
Source: global trafficTCP traffic: 192.168.2.4:50437 -> 162.159.36.2:53
Source: Joe Sandbox ViewIP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox ViewIP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox ViewJA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.196
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006CCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_006CCE44
Source: global trafficHTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dOKndhuHwpLNGYN&MD=PtaPUhX6 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725828361&P2=404&P3=2&P4=M5a2BJv5Ws434Qm11Ke2v0mxXAO551xEHIrvdezjAm6vppj3WexPYJie3hJd6X4TcMBd4lruncSnByi1G%2bmQgw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: rQA6HT74DpI9FtRW7IHx4vSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dOKndhuHwpLNGYN&MD=PtaPUhX6 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dOKndhuHwpLNGYN&MD=PtaPUhX6 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.2916444892.000002AEA6B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFF0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.2916444892.000002AEA6B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFF0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.2916444892.000002AEA6B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFF0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: bzib.nelreports.net
Source: global trafficDNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global trafficDNS traffic detected: DNS query: detectportal.firefox.com
Source: global trafficDNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: example.org
Source: global trafficDNS traffic detected: DNS query: ipv4only.arpa
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global trafficDNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global trafficDNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global trafficDNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: services.addons.mozilla.org
Source: global trafficDNS traffic detected: DNS query: contile.services.mozilla.com
Source: global trafficDNS traffic detected: DNS query: spocs.getpocket.com
Source: global trafficDNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global trafficDNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global trafficDNS traffic detected: DNS query: push.services.mozilla.com
Source: global trafficDNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global trafficDNS traffic detected: DNS query: support.mozilla.org
Source: global trafficDNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: firefox.exe, 00000005.00000003.2074629666.0000021B792F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 00000005.00000003.2181120946.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2180376447.0000021B7B881000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2180692539.0000021B7B885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org
Source: firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-aarch64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zi
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-arm-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86_64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-linux32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2.zip
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000005.00000003.2083166737.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2086154629.0000021B7C778000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 00000005.00000003.2181120946.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2180376447.0000021B7B881000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2180692539.0000021B7B885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000005.00000003.2086614291.0000021B77CC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075500985.0000021B77CE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1910984130.0000021B7BA0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000005.00000003.1869045956.0000021B7C614000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000005.00000003.1869045956.0000021B7C614000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000005.00000003.2075905717.0000021B774F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083535084.0000021B79DDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083535084.0000021B79DDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000005.00000003.1871052356.0000021B7921B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084613899.0000021B7921B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2079091414.0000021B7921B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.comX
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000005.00000003.1912830703.0000021B77371000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000005.00000003.1912830703.0000021B77371000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000005.00000003.2217326191.0000021B87B0B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000005.00000003.1734231349.0000021B7B9D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1860418190.0000021B7939C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2087631479.0000021B790F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1855922629.0000021E0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2078458377.0000021B7CED3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2221962688.0000021B88215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1738148418.0000021B793A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1731227899.0000021B7B95E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1852200650.0000021B7CE2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1848004530.0000021B7CE97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083069278.0000021B7BF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2216973821.0000021B88263000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1905782369.0000021B79395000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2088149060.0000021B7B960000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2087375424.0000021B7939A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1737466939.0000021B790F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2167315768.0000021B77AAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1906055715.0000021B7939D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870294832.0000021B7BA80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1860418190.0000021B793C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 00000005.00000003.2181120946.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2180376447.0000021B7B881000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2180692539.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2086154629.0000021B7C778000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2086154629.0000021B7C778000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000005.00000003.1868556436.0000021B7C743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2081528064.0000021B7C735000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869709339.0000021B7C1CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2082138859.0000021B7C58E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000005.00000003.1910005738.0000021B7C58E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2082138859.0000021B7C58E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulc
Source: firefox.exe, 00000005.00000003.1868556436.0000021B7C743000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xull
Source: mozilla-temp-41.5.drString found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000005.00000003.1868234414.0000021B7C7B9000.00000004.00000800.00020000.00000000.sdmp, 5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.dr, Session_13369697157603689.7.drString found in binary or memory: https://accounts.google.com
Source: 000003.log5.7.dr, Session_13369697157603689.7.drString found in binary or memory: https://accounts.google.com/
Source: History.7.dr, Favicons.7.drString found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/v3/signin/challeng
Source: recovery.jsonlz4.tmp.5.drString found in binary or memory: https://accounts.google.com/ServiceLogin?s
Source: Session_13369697157603689.7.drString found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.co
Source: Session_13369697157603689.7.drString found in binary or memory: https://accounts.google.com/_/bscframe
Source: Favicons.7.drString found in binary or memory: https://accounts.google.com/favicon.ico
Source: file.exe, 00000000.00000003.1655504942.0000000001930000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1655504942.000000000194F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000003.1657805297.00000221F8C1C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000002.1662882853.00000221F8C21000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2166801002.0000021B886B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2169571608.0000021B886A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2224007047.0000021B886A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2170638284.0000021B886A7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: file.exe, 00000000.00000002.1657414967.0000000001930000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1655504942.0000000001930000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdR
Source: Session_13369697157603689.7.drString found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2Fv3%2Fs
Source: firefox.exe, 00000005.00000003.1871052356.0000021B7921B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084613899.0000021B7921B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2079091414.0000021B7921B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://amazon.com
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000005.00000003.2075905717.0000021B774F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000005.00000003.2075905717.0000021B774F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000005.00000003.2074596226.0000021B79D39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084399641.0000021B79D39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/GMP/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release/Win
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/re
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drString found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drString found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000005.00000003.1841176399.0000021B7D528000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1768121145.0000021B7D4C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000005.00000003.2170909119.0000021B89AF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 00000005.00000003.2170909119.0000021B89AF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 00000005.00000003.2168791265.0000021B7CF55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2171020171.0000021B89AEA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 00000005.00000003.2171020171.0000021B89AEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2169084875.0000021B886CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2169571608.0000021B886C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 00000005.00000003.2170909119.0000021B89AF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 00000005.00000003.2169084875.0000021B886E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2171020171.0000021B89AEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2170909119.0000021B89AF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 00000005.00000003.2169571608.0000021B886C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678942
Source: firefox.exe, 00000005.00000003.2169084875.0000021B886E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2170909119.0000021B89AF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 00000005.00000003.2169571608.0000021B886C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=806991
Source: firefox.exe, 00000005.00000003.2169084875.0000021B886E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2171020171.0000021B89AEA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 00000005.00000003.2169084875.0000021B886E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2169653185.0000021B8869F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=815437
Source: firefox.exe, 00000005.00000003.2171020171.0000021B89AEA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 00000005.00000003.2169653185.0000021B8869F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=951422
Source: Reporting and NEL.7.drString found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.7.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.7.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: d032ef3c-af31-4039-91e2-7c6fbaf13f3f.tmp.8.dr, Network Persistent State0.7.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json0.7.drString found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.7.drString found in binary or memory: https://chromewebstore.google.com/
Source: 5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.drString found in binary or memory: https://clients2.google.com
Source: manifest.json.7.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.drString found in binary or memory: https://clients2.googleusercontent.com
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drString found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/993268
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/AccountsSignInUi
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureWebExtensionUncheckedLastErr
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000005.00000003.1912544936.0000021B774B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075905717.0000021B774B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: manifest.json.7.drString found in binary or memory: https://docs.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive.google.com/
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869940569.0000021B7BD86000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: 000003.log2.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log3.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log2.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: firefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/SelectOptionsLengthAssignmentW
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFF13000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000005.00000003.2157205146.0000021B87B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2157859109.0000021B87B3F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2155807900.0000021B87B4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000005.00000003.2075602517.0000021B77CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075905717.0000021B774B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 00000005.00000003.2075602517.0000021B77CD2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 00000005.00000003.2079091414.0000021B79245000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expe
Source: 5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.drString found in binary or memory: https://fonts.gstatic.com
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912544936.0000021B774DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1872044384.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075905717.0000021B774B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFF13000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFFC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFFC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFF30000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFFC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFFC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000005.00000003.1868234414.0000021B7C7B9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com
Source: firefox.exe, 00000005.00000003.1868234414.0000021B7C7E3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: firefox.exe, 00000005.00000003.1868234414.0000021B7C7E3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/0
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000005.00000003.2163861557.0000021B882D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://ideas.mozilla.org/
Source: prefs-1.js.5.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000005.00000003.2075905717.0000021B774F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFFF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000005.00000003.2075602517.0000021B77CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869940569.0000021B7BD86000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000005.00000003.2075602517.0000021B77CD2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000005.00000003.2079091414.0000021B79245000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074596226.0000021B79D39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084399641.0000021B79D39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869709339.0000021B7C1CC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000005.00000003.1845585397.0000021B7CEE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFF8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000005.00000003.1912306988.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2079654075.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075746995.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: 5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.drString found in binary or memory: https://play.google.com
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com
Source: firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/
Source: firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083838223.0000021B79D98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-linux-x64.zip
Source: firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083838223.0000021B79D98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-arm64.zip
Source: firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083838223.0000021B79D98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip
Source: firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083838223.0000021B79D98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-arm64.zip
Source: firefox.exe, 00000005.00000003.2083377673.0000021B7BA09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip
Source: firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083838223.0000021B79D98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x86.zip
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000005.00000003.1912306988.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2079654075.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075746995.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1910984130.0000021B7BA0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000005.00000003.2084282424.0000021B79D52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78BC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000005.00000003.1869940569.0000021B7BD86000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000005.00000003.1869940569.0000021B7BD86000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6B12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFF13000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFF13000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/pp
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000010.00000002.2916444892.000002AEA6BC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFF8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000005.00000003.1912306988.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2079654075.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075746995.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000005.00000003.1853112038.0000021B7C8E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1908762597.0000021B7C8E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1866217103.0000021B7C8E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2081360444.0000021B7C8E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869462498.0000021B7C8E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2078745777.0000021B7C8E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000005.00000003.1848004530.0000021B7CE97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1772609529.0000021B7D38D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1865763688.0000021B7CE97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 00000005.00000003.2151768792.0000021B79033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869940569.0000021B7BD86000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000005.00000003.2179091434.0000021B7B877000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179781251.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179470951.0000021B7B885000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2179044980.0000021B7B87B000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drString found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drString found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.drString found in binary or memory: https://www.google.com
Source: content_new.js.7.dr, content.js.7.drString found in binary or memory: https://www.google.com/chrome
Source: firefox.exe, 00000005.00000003.2154716908.0000021B8756F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2153758571.0000021B87533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2154088868.0000021B87537000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: Web Data.7.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869940569.0000021B7BD86000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
Source: 5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.drString found in binary or memory: https://www.googleapis.com
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: 5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.drString found in binary or memory: https://www.gstatic.com
Source: firefox.exe, 00000005.00000003.2075602517.0000021B77CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075905717.0000021B774B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 00000005.00000003.2157205146.0000021B87B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2155807900.0000021B87B4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: targeting.snapshot.json.tmp.5.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000018.00000002.2916970384.00000299EFFF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000005.00000003.1912976657.0000021B7735B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/O
Source: firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/j%~
Source: firefox.exe, 00000005.00000003.1870690721.0000021B792E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
Source: Top Sites.7.drString found in binary or memory: https://www.office.com/
Source: Top Sites.7.drString found in binary or memory: https://www.office.com/Office
Source: firefox.exe, 00000005.00000003.1869940569.0000021B7BDA6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFF0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50458
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 50443 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50457
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50466 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50456
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50455
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50469
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50468
Source: unknownNetwork traffic detected: HTTP traffic on port 50440 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50461
Source: unknownNetwork traffic detected: HTTP traffic on port 50448 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50461 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50463
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50462
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50465
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50464
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50467
Source: unknownNetwork traffic detected: HTTP traffic on port 50469 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50466
Source: unknownNetwork traffic detected: HTTP traffic on port 50455 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50470
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50472 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50479
Source: unknownNetwork traffic detected: HTTP traffic on port 50470 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50472
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50471
Source: unknownNetwork traffic detected: HTTP traffic on port 50464 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50474
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50473
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50478
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50477
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50481
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50480
Source: unknownNetwork traffic detected: HTTP traffic on port 50439 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50473 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50458 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50467 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50442 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50481 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50478 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 50462 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50447 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50456 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 50479 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50444 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50465 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50438 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50468 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50438
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 50441 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50439
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 50449 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50480 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50477 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50447
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50446
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50449
Source: unknownNetwork traffic detected: HTTP traffic on port 50446 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50448
Source: unknownNetwork traffic detected: HTTP traffic on port 50471 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50441
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50440
Source: unknownNetwork traffic detected: HTTP traffic on port 50463 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50442
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50444
Source: unknownNetwork traffic detected: HTTP traffic on port 50457 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50474 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.4:50438 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:50439 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:50440 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50442 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50441 version: TLS 1.2
Source: unknownHTTPS traffic detected: 18.65.39.112:443 -> 192.168.2.4:50444 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50447 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50448 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50449 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:50446 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50455 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50458 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50462 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50465 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50472 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50473 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50477 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50478 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50479 version: TLS 1.2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006CEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_006CEAFF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006CED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_006CED6A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006CEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_006CEAFF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_006BAA57
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006E9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_006E9576

System Summary

barindex
Binary is likely a compiled AutoIt script file
Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1649787281.0000000000712000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_fc5f0822-d
Source: file.exe, 00000000.00000000.1649787281.0000000000712000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_8b96c37e-3
Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_6e3cecce-a
Source: file.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_9a4732cd-2
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000002AEA70E7337 NtQuerySystemInformation,16_2_000002AEA70E7337
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000002AEA729B6B2 NtQuerySystemInformation,16_2_000002AEA729B6B2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BD5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_006BD5EB
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_006B1201
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_006BE8F6
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0065BF400_2_0065BF40
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006580600_2_00658060
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C20460_2_006C2046
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B82980_2_006B8298
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0068E4FF0_2_0068E4FF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0068676B0_2_0068676B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006E48730_2_006E4873
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0065CAF00_2_0065CAF0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0067CAA00_2_0067CAA0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0066CC390_2_0066CC39
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00686DD90_2_00686DD9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0066D07D0_2_0066D07D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0066B1190_2_0066B119
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006591C00_2_006591C0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006713940_2_00671394
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006717060_2_00671706
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0067781B0_2_0067781B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0066997D0_2_0066997D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006579200_2_00657920
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006719B00_2_006719B0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00677A4A0_2_00677A4A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00671C770_2_00671C77
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00677CA70_2_00677CA7
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006DBE440_2_006DBE44
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00689EEE0_2_00689EEE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00671F320_2_00671F32
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000002AEA70E733716_2_000002AEA70E7337
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000002AEA729B6B216_2_000002AEA729B6B2
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000002AEA729BDDC16_2_000002AEA729BDDC
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000002AEA729B6F216_2_000002AEA729B6F2
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00670A30 appears 46 times
Source: C:\Users\user\Desktop\file.exeCode function: String function: 0066F9F2 appears 31 times
Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engineClassification label: mal68.evad.winEXE@75/351@59/20
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C37B5 GetLastError,FormatMessageW,0_2_006C37B5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B10BF AdjustTokenPrivileges,CloseHandle,0_2_006B10BF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_006B16C3
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_006C51CD
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,0_2_006BD4DC
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_006C648E
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006542A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_006542A2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D4D281-1C84.pmaJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Local\Temp\firefoxJump to behavior
Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Login Data.7.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exeReversingLabs: Detection: 26%
Source: file.exeVirustotal: Detection: 25%
Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2076,i,1828721353005406552,4286803318795052176,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6360 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6556 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acc27241-3c31-435d-99e4-83922da2a76d} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b6bc6ed10 socket
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6816 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6816 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4260 -parentBuildID 20230927232528 -prefsHandle 4620 -prefMapHandle 3896 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cd84140-ac0b-45b4-9542-7f422c07c9d5} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b78b57710 rdd
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,12420635758166294745,5105143302083340951,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1980,i,9697535281678700936,11038712812997427642,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 33865 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e192372e-be7d-4bb5-b0f1-d46844c70d01} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b87784910 utility
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6736 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2076,i,1828721353005406552,4286803318795052176,262144 /prefetch:3Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acc27241-3c31-435d-99e4-83922da2a76d} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b6bc6ed10 socketJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4260 -parentBuildID 20230927232528 -prefsHandle 4620 -prefMapHandle 3896 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cd84140-ac0b-45b4-9542-7f422c07c9d5} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b78b57710 rddJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 33865 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e192372e-be7d-4bb5-b0f1-d46844c70d01} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b87784910 utilityJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:3Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6360 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6556 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6816 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6816 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6736 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,12420635758166294745,5105143302083340951,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1980,i,9697535281678700936,11038712812997427642,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: webauthn.pdb source: firefox.exe, 00000005.00000003.2181788280.0000021B8A241000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000005.00000003.2081900262.0000021B7C670000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.dr
Source: Binary string: wshbth.pdbGCTL source: firefox.exe, 00000005.00000003.2184689605.0000021B7B8BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NapiNSP.pdbUGP source: firefox.exe, 00000005.00000003.2184015694.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wshbth.pdb source: firefox.exe, 00000005.00000003.2184689605.0000021B7B8BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pnrpnsp.pdb source: firefox.exe, 00000005.00000003.2184398800.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NapiNSP.pdb source: firefox.exe, 00000005.00000003.2184015694.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000005.00000003.2081900262.0000021B7C670000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.dr
Source: Binary string: netprofm.pdb source: firefox.exe, 00000005.00000003.2182813988.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: webauthn.pdbGCTL source: firefox.exe, 00000005.00000003.2181788280.0000021B8A241000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pnrpnsp.pdbUGP source: firefox.exe, 00000005.00000003.2184398800.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: netprofm.pdbUGP source: firefox.exe, 00000005.00000003.2182813988.0000021B7B8B8000.00000004.00000020.00020000.00000000.sdmp
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_006542DE
Source: gmpopenh264.dll.tmp.5.drStatic PE information: section name: .rodata
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00670A76 push ecx; ret 0_2_00670A89
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpJump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868Jump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0066F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_0066F98E
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006E1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_006E1C41
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\Desktop\file.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-94911
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000002AEA70E7337 rdtsc 16_2_000002AEA70E7337
Source: C:\Users\user\Desktop\file.exeAPI coverage: 3.3 %
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_006BDBBE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C68EE FindFirstFileW,FindClose,0_2_006C68EE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_006C698F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_006BD076
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_006BD3A9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_006C9642
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_006C979D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_006C9B2B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_006C5C97
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_006542DE
Source: firefox.exe, 00000018.00000002.2915048952.00000299EFB5A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@A
Source: firefox.exe, 0000000C.00000002.2920500841.000001E6DDA00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: firefox.exe, 00000018.00000002.2919543358.00000299F0000000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW;
Source: firefox.exe, 00000010.00000002.2915248298.000002AEA693A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWP
Source: firefox.exe, 0000000C.00000002.2916005815.000001E6DD4FA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWQ
Source: firefox.exe, 0000000C.00000002.2916005815.000001E6DD4FA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: firefox.exe, 00000010.00000002.2919710139.000002AEA7120000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWf
Source: firefox.exe, 00000005.00000003.1912544936.0000021B774B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075905717.0000021B774B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919890270.000001E6DD919000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 00000010.00000002.2919710139.000002AEA7120000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: firefox.exe, 0000000C.00000002.2920500841.000001E6DDA00000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2919710139.000002AEA7120000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000002AEA70E7337 rdtsc 16_2_000002AEA70E7337
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006CEAA2 BlockInput,0_2_006CEAA2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00682622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00682622
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_006542DE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00674CE8 mov eax, dword ptr fs:[00000030h]0_2_00674CE8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_006B0B62
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00682622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00682622
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0067083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0067083F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006709D5 SetUnhandledExceptionFilter,0_2_006709D5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00670C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00670C21

HIPS / PFW / Operating System Protection Evasion

barindex
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeSection loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonlyJump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_006B1201
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00692BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00692BA5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006BB226 SendInput,keybd_event,0_2_006BB226
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006D22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_006D22DA
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_006B0B62
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_006B1663
Source: file.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exeBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00670698 cpuid 0_2_00670698
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006C8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_006C8195
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006AD27A GetUserNameW,0_2_006AD27A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0068BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_0068BB6F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_006542DE
Source: file.exeBinary or memory string: WIN_81
Source: file.exeBinary or memory string: WIN_XP
Source: file.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exeBinary or memory string: WIN_XPe
Source: file.exeBinary or memory string: WIN_VISTA
Source: file.exeBinary or memory string: WIN_7
Source: file.exeBinary or memory string: WIN_8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006D1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_006D1204
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006D1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_006D1806

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure2
Valid Accounts		1
Native API		1
DLL Side-Loading		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		21
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		2
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault AccountsScheduled Task/Job2
Valid Accounts		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol21
Input Capture		11
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Extra Window Memory Injection		2
Obfuscated Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin Shares3
Clipboard Data		3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
Valid Accounts		1
DLL Side-Loading		NTDS15
System Information Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
Access Token Manipulation		1
Extra Window Memory Injection		LSA Secrets131
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts112
Process Injection		1
Masquerading		Cached Domain Credentials1
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
Registry Run Keys / Startup Folder		2
Valid Accounts		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Virtualization/Sandbox Evasion		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
Access Token Manipulation		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron112
Process Injection		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1502493 Sample: file.exe Startdate: 01/09/2024 Architecture: WINDOWS Score: 68 50 us-west1.prod.sumo.prod.webservices.mozgcp.net 2->50 52 telemetry-incoming.r53-2.services.mozilla.com 2->52 54 26 other IPs or domains 2->54 72 Multi AV Scanner detection for submitted file 2->72 74 Binary is likely a compiled AutoIt script file 2->74 76 Machine Learning detection for sample 2->76 78 AI detected suspicious sample 2->78 8 file.exe 1 2->8         started        11 msedge.exe 45 526 2->11         started        14 firefox.exe 1 2->14         started        16 2 other processes 2->16 signatures3 process4 dnsIp5 80 Binary is likely a compiled AutoIt script file 8->80 82 Found API chain indicative of sandbox detection 8->82 18 msedge.exe 16 8->18         started        20 firefox.exe 1 8->20         started        68 192.168.2.4, 138, 443, 49723 unknown unknown 11->68 70 239.255.255.250 unknown Reserved 11->70 84 Maps a DLL or memory area into another process 11->84 22 msedge.exe 11->22         started        25 msedge.exe 11->25         started        27 msedge.exe 11->27         started        36 3 other processes 11->36 29 firefox.exe 3 207 14->29         started        32 msedge.exe 16->32         started        34 msedge.exe 16->34         started        signatures6 process7 dnsIp8 38 msedge.exe 18->38         started        56 s-part-0029.t-0009.t-msedge.net 13.107.246.57, 443, 49759, 49760 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 22->56 58 googlehosted.l.googleusercontent.com 142.250.185.161, 443, 49743 GOOGLEUS United States 22->58 64 12 other IPs or domains 22->64 60 services.addons.mozilla.org 18.65.39.112, 443, 50444 MIT-GATEWAYSUS United States 29->60 62 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49755, 49757, 50445 GOOGLEUS United States 29->62 66 8 other IPs or domains 29->66 46 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 29->46 dropped 48 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 29->48 dropped 40 firefox.exe 29->40         started        42 firefox.exe 29->42         started        44 firefox.exe 29->44         started        file9 process10

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
file.exe26%ReversingLabs
file.exe26%VirustotalBrowse
file.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
example.org0%VirustotalBrowse
prod.classify-client.prod.webservices.mozgcp.net0%VirustotalBrowse
chrome.cloudflare-dns.com0%VirustotalBrowse
prod.balrog.prod.cloudops.mozgcp.net0%VirustotalBrowse
services.addons.mozilla.org0%VirustotalBrowse
prod.detectportal.prod.cloudops.mozgcp.net0%VirustotalBrowse
prod.remote-settings.prod.webservices.mozgcp.net0%VirustotalBrowse
s-part-0029.t-0009.t-msedge.net0%VirustotalBrowse
sni1gl.wpc.nucdn.net0%VirustotalBrowse
telemetry-incoming.r53-2.services.mozilla.com0%VirustotalBrowse
prod.content-signature-chains.prod.webservices.mozgcp.net0%VirustotalBrowse
contile.services.mozilla.com0%VirustotalBrowse
ipv4only.arpa0%VirustotalBrowse
prod.ads.prod.webservices.mozgcp.net0%VirustotalBrowse
googlehosted.l.googleusercontent.com0%VirustotalBrowse
detectportal.firefox.com0%VirustotalBrowse
content-signature-2.cdn.mozilla.net0%VirustotalBrowse
push.services.mozilla.com0%VirustotalBrowse
spocs.getpocket.com0%VirustotalBrowse
clients2.googleusercontent.com0%VirustotalBrowse
bzib.nelreports.net0%VirustotalBrowse
shavar.services.mozilla.com0%VirustotalBrowse
206.23.85.13.in-addr.arpa1%VirustotalBrowse
support.mozilla.org0%VirustotalBrowse
us-west1.prod.sumo.prod.webservices.mozgcp.net0%VirustotalBrowse
firefox.settings.services.mozilla.com0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
https://duckduckgo.com/ac/?q=0%URL Reputationsafe
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e40%URL Reputationsafe
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l0%URL Reputationsafe
http://detectportal.firefox.com/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%0%URL Reputationsafe
http://www.mozilla.com00%URL Reputationsafe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.0%URL Reputationsafe
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl0%URL Reputationsafe
https://merino.services.mozilla.com/api/v1/suggest0%URL Reputationsafe
https://csp.withgoogle.com/csp/report-to/apps-themes0%URL Reputationsafe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect0%URL Reputationsafe
https://spocs.getpocket.com/spocs0%URL Reputationsafe
https://screenshots.firefox.com0%URL Reputationsafe
https://completion.amazon.com/search/complete?q=0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab0%URL Reputationsafe
https://monitor.firefox.com/breach-details/0%URL Reputationsafe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM0%URL Reputationsafe
https://xhr.spec.whatwg.org/#sync-warning0%URL Reputationsafe
https://profiler.firefox.com/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/addons/addon/0%URL Reputationsafe
https://tracking-protection-issues.herokuapp.com/new0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report0%URL Reputationsafe
https://api.accounts.firefox.com/v10%URL Reputationsafe
https://drive-daily-2.corp.google.com/0%URL Reputationsafe
https://fpn.firefox.com0%URL Reputationsafe
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc0%URL Reputationsafe
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections0%URL Reputationsafe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
http://exslt.org/dates-and-times0%URL Reputationsafe
https://drive-daily-1.corp.google.com/0%URL Reputationsafe
https://drive-daily-5.corp.google.com/0%URL Reputationsafe
https://bugzilla.mozilla.org/show_bug.cgi?id=12836010%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield0%URL Reputationsafe
https://bzib.nelreports.net/api/report?cat=bingbusiness0%URL Reputationsafe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=0%URL Reputationsafe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-0%Avira URL Cloudsafe
https://bugzilla.mozilla.org/show_bug.cgi?id=12662200%URL Reputationsafe
https://bugzilla.mo0%URL Reputationsafe
https://mitmdetection.services.mozilla.com/0%URL Reputationsafe
https://chromewebstore.google.com/0%URL Reputationsafe
https://services.addons.mozilla.org0%Avira URL Cloudsafe
https://drive-preprod.corp.google.com/0%URL Reputationsafe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture0%URL Reputationsafe
https://bugzilla.mozilla.org/show_bug.cgi?id=16789420%Avira URL Cloudsafe
https://spocs.getpocket.com/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/0%URL Reputationsafe
https://docs.google.com/0%Avira URL Cloudsafe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%0%URL Reputationsafe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f0%URL Reputationsafe
https://monitor.firefox.com/user/breach-stats?includeResolved=true0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-0%URL Reputationsafe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=0%URL Reputationsafe
https://monitor.firefox.com/user/dashboard0%URL Reputationsafe
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID0%URL Reputationsafe
https://monitor.firefox.com/about0%URL Reputationsafe
https://www.openh264.org/0%URL Reputationsafe
https://login.microsoftonline.com0%URL Reputationsafe
https://coverage.mozilla.org0%URL Reputationsafe
http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
https://csp.withgoogle.com/csp/report-to/AccountsSignInUi0%URL Reputationsafe
https://www.amazon.com/exec/obidos/external-search/0%Avira URL Cloudsafe
http://x1.c.lencr.org/00%URL Reputationsafe
http://x1.i.lencr.org/00%URL Reputationsafe
https://infra.spec.whatwg.org/#ascii-whitespace0%URL Reputationsafe
https://blocked.cdn.mozilla.net/0%URL Reputationsafe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored0%URL Reputationsafe
http://developer.mozilla.org/en/docs/DOM:element.addEventListener0%URL Reputationsafe
https://profiler.firefox.com0%URL Reputationsafe
https://outlook.live.com/default.aspx?rru=compose&to=%s0%URL Reputationsafe
https://mozilla.cloudflare-dns.com/dns-query0%URL Reputationsafe
https://bugzilla.mozilla.org/show_bug.cgi?id=16784480%URL Reputationsafe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg0%URL Reputationsafe
https://contile.services.mozilla.com/v1/tiles0%URL Reputationsafe
https://monitor.firefox.com/user/preferences0%URL Reputationsafe
https://screenshots.firefox.com/0%URL Reputationsafe
https://relay.firefox.com/api/v1/0%URL Reputationsafe
https://www.msn.com0%Avira URL Cloudsafe
https://github.com/mozilla-services/screenshots0%Avira URL Cloudsafe
https://services.addons.mozilla.org0%VirustotalBrowse
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc940%Avira URL Cloudsafe
https://bugzilla.mozilla.org/show_bug.cgi?id=16789420%VirustotalBrowse
https://docs.google.com/0%VirustotalBrowse
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-0%VirustotalBrowse
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/0%Avira URL Cloudsafe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta0%Avira URL Cloudsafe
https://www.msn.com0%VirustotalBrowse
https://github.com/mozilla-services/screenshots0%VirustotalBrowse
http://ocsp.rootca1.amazontrust.com0:0%Avira URL Cloudsafe
https://www.youtube.com/0%Avira URL Cloudsafe
https://www.amazon.com/exec/obidos/external-search/0%VirustotalBrowse
https://www.google.com/favicon.ico0%Avira URL Cloudsafe
http://detectportal.firefox.comX0%Avira URL Cloudsafe
http://127.0.0.1:0%Avira URL Cloudsafe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/0%VirustotalBrowse
https://amazon.com0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
example.org
93.184.215.14
truefalseunknown
prod.classify-client.prod.webservices.mozgcp.net
35.190.72.216
truefalseunknown
chrome.cloudflare-dns.com
172.64.41.3
truefalseunknown
prod.balrog.prod.cloudops.mozgcp.net
35.244.181.201
truefalseunknown
prod.detectportal.prod.cloudops.mozgcp.net
34.107.221.82
truefalseunknown
services.addons.mozilla.org
18.65.39.112
truefalseunknown
prod.remote-settings.prod.webservices.mozgcp.net
34.149.100.209
truefalseunknown
sni1gl.wpc.nucdn.net
152.199.21.175
truefalseunknown
contile.services.mozilla.com
34.117.188.166
truefalseunknown
s-part-0029.t-0009.t-msedge.net
13.107.246.57
truefalseunknown
prod.content-signature-chains.prod.webservices.mozgcp.net
34.160.144.191
truefalseunknown
us-west1.prod.sumo.prod.webservices.mozgcp.net
34.149.128.2
truefalseunknown
ipv4only.arpa
192.0.0.170
truefalseunknown
prod.ads.prod.webservices.mozgcp.net
34.117.188.166
truefalseunknown
push.services.mozilla.com
34.107.243.93
truefalseunknown
googlehosted.l.googleusercontent.com
142.250.185.161
truefalseunknown
telemetry-incoming.r53-2.services.mozilla.com
34.120.208.123
truefalseunknown
spocs.getpocket.com
unknown
unknownfalseunknown
detectportal.firefox.com
unknown
unknownfalseunknown
clients2.googleusercontent.com
unknown
unknownfalseunknown
bzib.nelreports.net
unknown
unknownfalseunknown
content-signature-2.cdn.mozilla.net
unknown
unknownfalseunknown
support.mozilla.org
unknown
unknownfalseunknown
firefox.settings.services.mozilla.com
unknown
unknownfalseunknown
shavar.services.mozilla.com
unknown
unknownfalseunknown
206.23.85.13.in-addr.arpa
unknown
unknownfalseunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://www.google.com/favicon.icofalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crxfalse
  • Avira URL Cloud: safe
unknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://duckduckgo.com/chrome_newtabWeb Data.7.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1678942firefox.exe, 00000005.00000003.2169571608.0000021B886C0000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://duckduckgo.com/ac/?q=Web Data.7.drfalse
  • URL Reputation: safe
unknown
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lfirefox.exe, 00000018.00000002.2916970384.00000299EFFC3000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://detectportal.firefox.com/firefox.exe, 00000005.00000003.1869045956.0000021B7C614000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.orgfirefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.mozilla.com0firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2086154629.0000021B7C778000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drfalse
  • URL Reputation: safe
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drfalse
  • URL Reputation: safe
unknown
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecyclfirefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://merino.services.mozilla.com/api/v1/suggestfirefox.exe, 00000018.00000002.2916970384.00000299EFF8E000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://csp.withgoogle.com/csp/report-to/apps-themesReporting and NEL.7.drfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protectfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://spocs.getpocket.com/spocsfirefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://docs.google.com/manifest.json.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://screenshots.firefox.comfirefox.exe, 00000005.00000003.1912306988.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2079654075.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075746995.0000021B77CC1000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://completion.amazon.com/search/complete?q=firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-reportfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tabfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/breach-details/firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEMfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://xhr.spec.whatwg.org/#sync-warningfirefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.amazon.com/exec/obidos/external-search/firefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869940569.0000021B7BD86000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://profiler.firefox.com/firefox.exe, 00000005.00000003.2074230553.0000021B79D98000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.msn.comfirefox.exe, 00000005.00000003.1870690721.0000021B792E1000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/mozilla-services/screenshotsfirefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/addon/firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://tracking-protection-issues.herokuapp.com/newfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-reportfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94firefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-reportfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://api.accounts.firefox.com/v1firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-daily-2.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://fpn.firefox.comfirefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912544936.0000021B774DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1872044384.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075905717.0000021B774B5000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullScfirefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protectionsfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=Web Data.7.drfalse
  • URL Reputation: safe
unknown
http://exslt.org/dates-and-timesfirefox.exe, 00000005.00000003.1912830703.0000021B77371000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&ctafirefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drfalse
  • Avira URL Cloud: safe
unknown
http://ocsp.rootca1.amazontrust.com0:firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-1.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://www.youtube.com/firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFF0C000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://drive-daily-5.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601firefox.exe, 00000005.00000003.2170909119.0000021B89AF3000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shieldfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://detectportal.firefox.comXfirefox.exe, 00000005.00000003.1871052356.0000021B7921B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084613899.0000021B7921B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2079091414.0000021B7921B000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://bzib.nelreports.net/api/report?cat=bingbusinessReporting and NEL.7.drfalse
  • URL Reputation: safe
unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=firefox.exe, 00000018.00000002.2916970384.00000299EFFC3000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://127.0.0.1:firefox.exe, 00000005.00000003.2074629666.0000021B792F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220firefox.exe, 00000005.00000003.2171020171.0000021B89AEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2169084875.0000021B886CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2169571608.0000021B886C0000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://bugzilla.mofirefox.exe, 00000005.00000003.1841176399.0000021B7D528000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1768121145.0000021B7D4C7000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://mitmdetection.services.mozilla.com/firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://amazon.comfirefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://chromewebstore.google.com/manifest.json0.7.drfalse
  • URL Reputation: safe
unknown
https://drive-preprod.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://chrome.google.com/webstore/manifest.json0.7.drfalse
  • Avira URL Cloud: safe
unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapturefirefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://spocs.getpocket.com/firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6B12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2916970384.00000299EFF13000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-ffirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_rfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=truefirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-reportfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-firefox.exe, 00000005.00000003.2084282424.0000021B79D52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78BC7000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://play.google.com5375ead1-407f-49d4-b88b-1763db4a64e2.tmp.8.drfalse
  • Avira URL Cloud: safe
unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.inbox.lv/rfc2368/?value=%sufirefox.exe, 00000005.00000003.2083838223.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2074230553.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911199065.0000021B79DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/dashboardfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_IDfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/aboutfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://mozilla.org/MPL/2.0/.firefox.exe, 00000005.00000003.1734231349.0000021B7B9D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1860418190.0000021B7939C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2087631479.0000021B790F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1855922629.0000021E0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2078458377.0000021B7CED3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2221962688.0000021B88215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1738148418.0000021B793A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1731227899.0000021B7B95E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1852200650.0000021B7CE2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1848004530.0000021B7CE97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2073763729.0000021B7BA72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2083069278.0000021B7BF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2216973821.0000021B88263000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1905782369.0000021B79395000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2088149060.0000021B7B960000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2087375424.0000021B7939A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1737466939.0000021B790F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2167315768.0000021B77AAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1906055715.0000021B7939D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870294832.0000021B7BA80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1860418190.0000021B793C6000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.openh264.org/firefox.exe, 00000005.00000003.1869940569.0000021B7BDA6000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://login.microsoftonline.comfirefox.exe, 00000005.00000003.1845585397.0000021B7CEE9000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://coverage.mozilla.orgfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0firefox.exe, 00000005.00000003.2090243068.0000021B7D600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2086154629.0000021B7C778000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.5.drfalse
  • URL Reputation: safe
unknown
https://csp.withgoogle.com/csp/report-to/AccountsSignInUiReporting and NEL.7.drfalse
  • URL Reputation: safe
unknown
http://x1.c.lencr.org/0firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://x1.i.lencr.org/0firefox.exe, 00000005.00000003.1911588569.0000021B792B2000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://infra.spec.whatwg.org/#ascii-whitespacefirefox.exe, 00000005.00000003.2167315768.0000021B77A63000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://blocked.cdn.mozilla.net/firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnoredfirefox.exe, 00000005.00000003.1912544936.0000021B774B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2075905717.0000021B774B5000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://developer.mozilla.org/en/docs/DOM:element.addEventListenerfirefox.exe, 00000005.00000003.1907445540.0000021B7E2C7000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://profiler.firefox.comfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://outlook.live.com/default.aspx?rru=compose&to=%sfirefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://mozilla.cloudflare-dns.com/dns-queryfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448firefox.exe, 00000005.00000003.2169084875.0000021B886E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2171020171.0000021B89AEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2170909119.0000021B89AF3000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://mail.yahoo.co.jp/compose/?To=%sfirefox.exe, 00000005.00000003.2083535084.0000021B79DD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1854196131.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1856340408.0000021B78CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870495672.0000021B79DC6000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpgfirefox.exe, 00000005.00000003.2074724752.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1912624213.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1870690721.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1911588569.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2085032672.0000021B78B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1871175276.0000021B78B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2084490224.0000021B792C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.2076111269.0000021B773B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2916405075.000001E6DD7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916444892.000002AEA6BEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2919713202.00000299F0103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.5.drfalse
  • URL Reputation: safe
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.icoWeb Data.7.drfalse
  • Avira URL Cloud: safe
unknown
https://contile.services.mozilla.com/v1/tilesfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/user/preferencesfirefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://screenshots.firefox.com/firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1910984130.0000021B7BA0A000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.google.com/searchfirefox.exe, 00000005.00000003.1722452221.0000021B7B657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722751454.0000021B7B681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722624473.0000021B7B66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721740457.0000021B7B617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721999206.0000021B7B62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1721259997.0000021B79300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1722262021.0000021B7B641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000005.00000003.1869940569.0000021B7BD86000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://relay.firefox.com/api/v1/firefox.exe, 0000000C.00000002.2919240849.000001E6DD870000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2918734882.000002AEA7060000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2916666716.00000299EFD70000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
142.250.80.46
unknownUnited States
15169GOOGLEUSfalse
152.195.19.97
unknownUnited States
15133EDGECASTUSfalse
162.159.61.3
unknownUnited States
13335CLOUDFLARENETUSfalse
34.117.188.166
contile.services.mozilla.comUnited States
139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
142.251.32.106
unknownUnited States
15169GOOGLEUSfalse
142.250.185.161
googlehosted.l.googleusercontent.comUnited States
15169GOOGLEUSfalse
172.64.41.3
chrome.cloudflare-dns.comUnited States
13335CLOUDFLARENETUSfalse
34.120.208.123
telemetry-incoming.r53-2.services.mozilla.comUnited States
15169GOOGLEUSfalse
142.250.65.196
unknownUnited States
15169GOOGLEUSfalse
13.107.246.57
s-part-0029.t-0009.t-msedge.netUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
34.149.100.209
prod.remote-settings.prod.webservices.mozgcp.netUnited States
2686ATGS-MMD-ASUSfalse
34.107.243.93
push.services.mozilla.comUnited States
15169GOOGLEUSfalse
34.107.221.82
prod.detectportal.prod.cloudops.mozgcp.netUnited States
15169GOOGLEUSfalse
35.244.181.201
prod.balrog.prod.cloudops.mozgcp.netUnited States
15169GOOGLEUSfalse
239.255.255.250
unknownReserved
unknownunknownfalse
18.65.39.112
services.addons.mozilla.orgUnited States
3MIT-GATEWAYSUSfalse
35.190.72.216
prod.classify-client.prod.webservices.mozgcp.netUnited States
15169GOOGLEUSfalse
34.160.144.191
prod.content-signature-chains.prod.webservices.mozgcp.netUnited States
2686ATGS-MMD-ASUSfalse

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1502493
Start date and time:2024-09-01 22:45:05 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 6m 51s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:27
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:file.exe
Detection:MAL
Classification:mal68.evad.winEXE@75/351@59/20
EGA Information:
  • Successful, ratio: 50%
HCA Information:
  • Successful, ratio: 96%
  • Number of executed functions: 36
  • Number of non-executed functions: 315
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 66.102.1.84, 13.107.42.16, 204.79.197.239, 13.107.21.239, 142.250.186.78, 13.107.6.158, 2.19.126.145, 2.19.126.152, 2.23.209.189, 2.23.209.130, 2.23.209.187, 2.23.209.176, 2.23.209.182, 2.23.209.133, 2.23.209.185, 2.23.209.177, 2.23.209.179, 142.250.184.195, 142.250.186.67, 23.96.180.189, 41.63.96.128, 192.229.221.95, 88.221.134.155, 88.221.134.209, 142.250.185.110, 2.18.121.79, 2.18.121.73, 64.233.184.84, 74.125.206.84, 52.11.251.113, 35.81.254.255, 54.244.114.242, 142.250.186.110, 2.23.209.161, 2.23.209.149, 2.23.209.150, 2.23.209.140, 142.250.184.234, 142.250.186.138, 142.250.80.35, 142.251.40.163
  • Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, www.bing.com, fs.microsoft.com, shavar.prod.mozaws.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, wildcardtlu-ssl.azureedge.net, edgeassetservice.azureedge.net, clients.l.google.com, location.services.mozilla.com, ciscobinary.openh264.org, config.edge.skype.com.trafficmanager.net, incoming.telemetry.mozilla.org, a17.rackcdn.com.mdc.edgesuite.net, arc.msn.com, www.bing.com.edgekey.net, redirector.gvt1.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, safebrowsing.googleapis.com, config.edge.skype.com, edge-microsoft-com.dual-a-0036.a-msedge.n
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtCreateFile calls found.
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtWriteVirtualMemory calls found.
  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

TimeTypeDescription
16:46:44API Interceptor1x Sleep call for process: firefox.exe modified
21:46:04AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
21:46:12AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
162.159.61.3file.exeGet hashmaliciousUnknownBrowse
    file.exeGet hashmaliciousAmadey, StealcBrowse
      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
        file.exeGet hashmaliciousAmadey, StealcBrowse
          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
            file.exeGet hashmaliciousAmadey, StealcBrowse
              file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                nitro.exeGet hashmaliciousLummaC StealerBrowse
                  file.exeGet hashmaliciousAmadey, StealcBrowse
                    Pralevia.exeGet hashmaliciousStealit, LummaC StealerBrowse
                      34.117.188.166file.exeGet hashmaliciousUnknownBrowse
                        file.exeGet hashmaliciousUnknownBrowse
                          MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zipGet hashmaliciousUnknownBrowse
                            https://wetransfer.com/downloads/e3c914f2e6f4651b1445415756262fa620240826020905/640d590327db92754fa0159c45d4f92720240826020905/4529de?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgridGet hashmaliciousUnknownBrowse
                              https://pentaleon.com/?sragyzsragyzGet hashmaliciousUnknownBrowse
                                file.exeGet hashmaliciousUnknownBrowse
                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                    file.exeGet hashmaliciousUnknownBrowse
                                      file.exeGet hashmaliciousUnknownBrowse
                                        file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          152.195.19.97http://ustteam.com/Get hashmaliciousUnknownBrowse
                                          • www.ust.com/

                                          Domains

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          prod.remote-settings.prod.webservices.mozgcp.netfile.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zipGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 34.149.100.209
                                          example.orgfile.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zipGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 93.184.215.14
                                          chrome.cloudflare-dns.comfile.exeGet hashmaliciousUnknownBrowse
                                          • 172.64.41.3
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 172.64.41.3
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 162.159.61.3
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 162.159.61.3
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 162.159.61.3
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 172.64.41.3
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 162.159.61.3
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 172.64.41.3
                                          nitro.exeGet hashmaliciousLummaC StealerBrowse
                                          • 172.64.41.3
                                          nitro.exeGet hashmaliciousLummaC StealerBrowse
                                          • 162.159.61.3
                                          services.addons.mozilla.orgfile.exeGet hashmaliciousUnknownBrowse
                                          • 52.222.236.80
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 52.222.236.23
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 18.65.39.85
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 52.222.236.80
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 18.65.39.31
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 52.222.236.23
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 52.222.236.120
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 52.222.236.48
                                          MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zipGet hashmaliciousUnknownBrowse
                                          • 3.165.136.19
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 18.65.39.31

                                          ASNs

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfile.exeGet hashmaliciousUnknownBrowse
                                          • 34.117.188.166
                                          firmware.i686.elfGet hashmaliciousUnknownBrowse
                                          • 34.66.215.63
                                          firmware.mipsel.elfGet hashmaliciousUnknownBrowse
                                          • 34.67.142.130
                                          get wifi info temp.exeGet hashmaliciousBabuk, TrojanRansomBrowse
                                          • 34.117.59.81
                                          https://66d29bf389fa9da58249d6b4--joyful-cupcake-4f3db5.netlify.app/Get hashmaliciousUnknownBrowse
                                          • 34.117.59.81
                                          https://66d2795a9886f088ed2f8c66--loquacious-pixie-9e563f.netlify.app/Get hashmaliciousUnknownBrowse
                                          • 34.117.59.81
                                          http://66d279a2c54e748a99eb8b73--loquacious-pixie-9e563f.netlify.app/Get hashmaliciousUnknownBrowse
                                          • 34.117.59.81
                                          http://telegiamr.club/Get hashmaliciousTelegram PhisherBrowse
                                          • 34.117.59.81
                                          https://66d2831fd497be94d6e1d2ea--loquacious-pixie-9e563f.netlify.app/Get hashmaliciousUnknownBrowse
                                          • 34.117.59.81
                                          https://66d249dc62742664d8af06a6--charming-sawine-adb7fe.netlify.app/Get hashmaliciousUnknownBrowse
                                          • 34.117.59.81
                                          CLOUDFLARENETUSsnake-cleaned_reversed.bak2.exeGet hashmaliciousSnake KeyloggerBrowse
                                          • 188.114.96.3
                                          SecuriteInfo.com.Win64.Malware-gen.24437.6720.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                                          • 104.21.84.50
                                          snake.exeGet hashmaliciousSnake KeyloggerBrowse
                                          • 188.114.97.3
                                          snake.exeGet hashmaliciousSnake KeyloggerBrowse
                                          • 188.114.97.3
                                          librewolf-124.0.2-1-windows-x86_64-setup.exeGet hashmaliciousAgent Tesla, AgentTesla, HTMLPhisherBrowse
                                          • 172.67.157.127
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 172.64.41.3
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 172.64.41.3
                                          4.7.exeGet hashmaliciousUnknownBrowse
                                          • 162.159.128.233
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 172.64.41.3
                                          stub.exeGet hashmaliciousStealeriumBrowse
                                          • 162.159.136.232
                                          CLOUDFLARENETUSsnake-cleaned_reversed.bak2.exeGet hashmaliciousSnake KeyloggerBrowse
                                          • 188.114.96.3
                                          SecuriteInfo.com.Win64.Malware-gen.24437.6720.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                                          • 104.21.84.50
                                          snake.exeGet hashmaliciousSnake KeyloggerBrowse
                                          • 188.114.97.3
                                          snake.exeGet hashmaliciousSnake KeyloggerBrowse
                                          • 188.114.97.3
                                          librewolf-124.0.2-1-windows-x86_64-setup.exeGet hashmaliciousAgent Tesla, AgentTesla, HTMLPhisherBrowse
                                          • 172.67.157.127
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 172.64.41.3
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 172.64.41.3
                                          4.7.exeGet hashmaliciousUnknownBrowse
                                          • 162.159.128.233
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 172.64.41.3
                                          stub.exeGet hashmaliciousStealeriumBrowse
                                          • 162.159.136.232
                                          EDGECASTUSfile.exeGet hashmaliciousUnknownBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 152.195.19.97
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 152.195.19.97

                                          JA3 Fingerprints

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          28a2c9bd18a11de089ef85a160da29e4file.exeGet hashmaliciousUnknownBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          ^=L@test_PC_FilE_2024_as_P@ssKey=^.zipGet hashmaliciousGo InjectorBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          http://virastman.irGet hashmaliciousUnknownBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          file.exeGet hashmaliciousAmadey, StealcBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          https://pinpoint-insights.com/interx/tracker?op=click&id=1bcf8.e84f&url=https://splendo-alu.com/proposed-report22.html#skolverket@skolverket.se&id=71deGet hashmaliciousHTMLPhisherBrowse
                                          • 13.85.23.86
                                          • 184.28.90.27
                                          • 40.68.123.157
                                          • 13.85.23.206
                                          • 20.114.59.183
                                          fb0aa01abe9d8e4037eb3473ca6e2dcafile.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zipGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • 35.244.181.201
                                          • 34.149.100.209
                                          • 34.160.144.191
                                          • 18.65.39.112
                                          • 34.120.208.123

                                          Dropped Files

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpfile.exeGet hashmaliciousUnknownBrowse
                                            file.exeGet hashmaliciousUnknownBrowse
                                              file.exeGet hashmaliciousUnknownBrowse
                                                file.exeGet hashmaliciousUnknownBrowse
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                    file.exeGet hashmaliciousUnknownBrowse
                                                      file.exeGet hashmaliciousUnknownBrowse
                                                        file.exeGet hashmaliciousUnknownBrowse
                                                          MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zipGet hashmaliciousUnknownBrowse
                                                            file.exeGet hashmaliciousUnknownBrowse
                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)file.exeGet hashmaliciousUnknownBrowse
                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                  file.exeGet hashmaliciousUnknownBrowse
                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                      file.exeGet hashmaliciousUnknownBrowse
                                                                        file.exeGet hashmaliciousUnknownBrowse
                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                              MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zipGet hashmaliciousUnknownBrowse
                                                                                file.exeGet hashmaliciousUnknownBrowse

                                                                                  Created / dropped Files

                                                                                  C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_06a46a8d-5064-47bf-985d-ccc8f93ff01f.json (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):7610
                                                                                  Entropy (8bit):5.1662852406320825
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:fjjMXLHwcbhbVbTbfbRbObtbyEl7nkrUJA6WnSrDtTJd/SkDrX:bYccNhnzFSJErnBnSrDhJd/R
                                                                                  MD5:E3A0FF8DC4AB43326622684282F10671
                                                                                  SHA1:3BD4C30CC695B10790EE8592ED85D6596CC1DED3
                                                                                  SHA-256:F68EE8493F6941733A9508BCFDC150DD04354B1B5BA25AC3F766A0BE556F278D
                                                                                  SHA-512:CBD4693AF0BF5FEE3C460A89F432C8095C8645C027844CA3BE79DD34928A653DC53E3C873F219FBE266ABD37D884D6C4F77F65976B986E23EC7849F1CD899670
                                                                                  Malicious:false
                                                                                  Preview:{"type":"uninstall","id":"06a46a8d-5064-47bf-985d-ccc8f93ff01f","creationDate":"2024-09-01T22:36:10.729Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                  C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_06a46a8d-5064-47bf-985d-ccc8f93ff01f.json.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):7610
                                                                                  Entropy (8bit):5.1662852406320825
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:fjjMXLHwcbhbVbTbfbRbObtbyEl7nkrUJA6WnSrDtTJd/SkDrX:bYccNhnzFSJErnBnSrDhJd/R
                                                                                  MD5:E3A0FF8DC4AB43326622684282F10671
                                                                                  SHA1:3BD4C30CC695B10790EE8592ED85D6596CC1DED3
                                                                                  SHA-256:F68EE8493F6941733A9508BCFDC150DD04354B1B5BA25AC3F766A0BE556F278D
                                                                                  SHA-512:CBD4693AF0BF5FEE3C460A89F432C8095C8645C027844CA3BE79DD34928A653DC53E3C873F219FBE266ABD37D884D6C4F77F65976B986E23EC7849F1CD899670
                                                                                  Malicious:false
                                                                                  Preview:{"type":"uninstall","id":"06a46a8d-5064-47bf-985d-ccc8f93ff01f","creationDate":"2024-09-01T22:36:10.729Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\03cb2e50-eea9-414d-8a21-5dd1c1337051.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:modified
                                                                                  Size (bytes):8090
                                                                                  Entropy (8bit):5.814537511717035
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:asNABYj9LeiRU/1Qnkyhm6qRAq1k8SPxVLZ7VTiq:asNAaB+KkyI6q3QxVNZTiq
                                                                                  MD5:E41FC5A35CDB0EDE042314E5CD3E2C06
                                                                                  SHA1:DD89B246C6073DD878F22933A3866FF398D978BC
                                                                                  SHA-256:6E5BAB496FAF0ADF7EF11AC917FE25EBE184C465601BD2A800F2B07F6BD16BCC
                                                                                  SHA-512:89177D78862B2E781FC71FBC23B63C7AA7851F4646040199D2C88EA4AD12A3F094AA60BF8629BE9391C6EBC189F8744D9952AAAE68E91DA56F78471DE38C167D
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0d05f043-c838-44dc-996c-564852ec4aa4.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):8321
                                                                                  Entropy (8bit):5.791281900673628
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:fsNwBYj9LeiRUzAjwkye6qRAq1k8SPxVLZ7VTiQ:fsNwaBWWbye6q3QxVNZTiQ
                                                                                  MD5:9576E7A1D96B9E9CFC60612114A91429
                                                                                  SHA1:01FFEC5ADF9B5FC43909CB256BDBDAB3C1CAF18A
                                                                                  SHA-256:D0DBB00F5402A7EA867AB256F2C4AA4CBF602D9F898B4EEE9D500196CF76599D
                                                                                  SHA-512:631FDEA29179A8CBD37C973E63D12D2F9E87937C0A0AF236FA755FA8EBF531F93A3EAACBA599B48C204D3B65091CD79B01DFAE0F1F4CCDBEFBAED7E36522D412
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1d2a3ef5-5567-4cbd-b94b-347ef0702f49.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:modified
                                                                                  Size (bytes):23967
                                                                                  Entropy (8bit):6.049797004654132
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:btMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwheP28JGbX5yR0+Mh0lkdHd5q2:RMGQ7FCYXGIgtDAWtJ4n14PxGD5yRUhf
                                                                                  MD5:519EBA29DB7174B24ECAE4D5E6F3A345
                                                                                  SHA1:E9449F0FD29E91C1BD7254F49A6F4C061FACB0DB
                                                                                  SHA-256:6349A9FCB48FC8A89A0CC663B675AE5B500D1FFC43C2ED675838E01A00397706
                                                                                  SHA-512:489E07023FC62F3A25BF72B52A382F9766C5ED44CB1A2BF15EDF124F3C828C2096B77994F135E10CF363BC52B0FBDFC37AD88D761D38F720E71EEFB113C18DCE
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\20259223-8128-4a66-b97b-0f66ed2a8718.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):22925
                                                                                  Entropy (8bit):6.046657601830151
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:btMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwheP28JKby1+Mh0lkdHd5q3:RMGQ7FCYXGIgtDAWtJ4n14PxKbyJh02I
                                                                                  MD5:49FE290D2CCFCD4FEF9CFD3B98DB1B1D
                                                                                  SHA1:97F3A217113B6907A0F0B013879359DCBF7EE719
                                                                                  SHA-256:A3A5108F08FCE7092CE192C41357D0574C32A7408137476E6AD8339E26D34BF9
                                                                                  SHA-512:1CA338D509CFB65DAAB86FDCF3B02B24B3021B394AB4CAA7F1FA9B707BCFC2611523688F7A29423280E3A1C4D970F7FC8B9A41B8366D58E9D47921B4D349BE49
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\317f182c-efd7-4559-9309-8f3a9603d614.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):22925
                                                                                  Entropy (8bit):6.046666325726993
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:btMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwheP28Jfby1+Mh0lkdHd5q3:RMGQ7FCYXGIgtDAWtJ4n14PxfbyJh02I
                                                                                  MD5:9257423215DC57809C20360781EABB7B
                                                                                  SHA1:A63D2CA9A6A0CA1C24E6009EB0BFB7460CC21B95
                                                                                  SHA-256:D893BD7BD3A3B9D3B93DAAF60261F1B2A6A48ED26365C437C28C4D3459146E45
                                                                                  SHA-512:CC2BB6D03DA790DB1D57D756A81FC3080A1CC4E63B93DA35397152F55645F16F4BFA22B806AE5A08809E2857EFC79542DE25E3736F4B58D47EA95909C0A19649
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\46c327da-99b7-4608-bc3a-f523ac729e86.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):23967
                                                                                  Entropy (8bit):6.049797004654132
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:btMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwheP28JGbX5yR0+Mh0lkdHd5q2:RMGQ7FCYXGIgtDAWtJ4n14PxGD5yRUhf
                                                                                  MD5:519EBA29DB7174B24ECAE4D5E6F3A345
                                                                                  SHA1:E9449F0FD29E91C1BD7254F49A6F4C061FACB0DB
                                                                                  SHA-256:6349A9FCB48FC8A89A0CC663B675AE5B500D1FFC43C2ED675838E01A00397706
                                                                                  SHA-512:489E07023FC62F3A25BF72B52A382F9766C5ED44CB1A2BF15EDF124F3C828C2096B77994F135E10CF363BC52B0FBDFC37AD88D761D38F720E71EEFB113C18DCE
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4fc2682d-ceff-477c-952b-657b8b30badc.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:modified
                                                                                  Size (bytes):23967
                                                                                  Entropy (8bit):6.049802068485145
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:btMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwheP28JGblkyR0+Mh0lkdHd5q2:RMGQ7FCYXGIgtDAWtJ4n14PxGBkyRUhf
                                                                                  MD5:813193BEB2740078A58FBE7CA145E821
                                                                                  SHA1:2DE4F935F66CDB42AB3236AF4E82B52C3371085D
                                                                                  SHA-256:1477BFD0E602C7B8D545E024A408719CEE0726997ACA6D58FCF8618DB249FB78
                                                                                  SHA-512:A15E58B4E1B052A9C4A019C709902E1E56496A82AE0F5B5D26452D8773A923B3F59B129F2A340BCCC8A449913E1D8453235C01137C0600999EEE4CB0F6CDEF94
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5675a717-4e3a-4a91-8656-3aed15cd469e.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5a6f9fbb-5dd6-4697-a0b2-c2db61cac853.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):25053
                                                                                  Entropy (8bit):6.031346382519399
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:RMGQ7FCYXGIgtDAWtJ4v14Px9/byJh02tdg:RMGQ5XMB41BI
                                                                                  MD5:D8AE7224FDD927A95F5EDF1F8D1E01D5
                                                                                  SHA1:9914ADA417D2C23D69BD8EAE78830D5BF39982A2
                                                                                  SHA-256:A837C345743A4C9B39494603CF1CDCEC1A5F7E73DEF70BE8BD288170BD48509A
                                                                                  SHA-512:0543C69728585182B9C3B1F0EE19FFFB280FC1AA8C662D4B78018E5B5D0FFF78F74F0CE44954ACDED0C5B55E133778745230F00A744FFCBC1A4B59F8A1024194
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5c4af635-e92a-4aae-8fa4-6e8afeac9300.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):22852
                                                                                  Entropy (8bit):6.046037445268622
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:btMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwheP28JNdy1+Mh0lkdHd5q2:RMGQ7FCYXGIgtDAWtJ4n14PxNdyJh02D
                                                                                  MD5:4910A81A32F22BD78FC4CC1AF03B3324
                                                                                  SHA1:955DF621A6299E4FD5450BE712E88D1E35D5A6E5
                                                                                  SHA-256:35FAF2CF1B6C95713954ABAAFF85C7DF42012AE3959A5D5C7547476BFE4E49EF
                                                                                  SHA-512:FCD97DE6D9CCBDC3CB9E493473C635FC020A78EFACED90D6D9A64D1661830CACD0982DAE2991969E25B6734BE7B69C70604CD7A938635A7B3F56DD5C17111632
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\625da35c-b80b-4d96-850e-156f1ff14d03.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):25104
                                                                                  Entropy (8bit):6.030541646477696
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:RMGQ7FCYXGIgtDAWtJ4vk4Px9abyJh02tdg:RMGQ5XMB4kkI
                                                                                  MD5:90BC79665B52203B5140466AA017250A
                                                                                  SHA1:CBDAC63EE9EFBF3E4B15967E8F2D26A95513F575
                                                                                  SHA-256:17D24B308622AC5A96038259D3F6E712E72E0EAA29E54BD880C4DC123E5E992F
                                                                                  SHA-512:39208923DAD369674FF54C9ED274AB5C5C3A0290CD55649DFD76F122256CE69634922BC991E7EDCF527FA976A4529A00EE1408D118C142362BA316C1A5E4D356
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\72397306-d4db-4d03-92fd-50e22fe1d8cc.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):8090
                                                                                  Entropy (8bit):5.814537511717035
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:asNABYj9LeiRU/1Qnkyhm6qRAq1k8SPxVLZ7VTiq:asNAaB+KkyI6q3QxVNZTiq
                                                                                  MD5:E41FC5A35CDB0EDE042314E5CD3E2C06
                                                                                  SHA1:DD89B246C6073DD878F22933A3866FF398D978BC
                                                                                  SHA-256:6E5BAB496FAF0ADF7EF11AC917FE25EBE184C465601BD2A800F2B07F6BD16BCC
                                                                                  SHA-512:89177D78862B2E781FC71FBC23B63C7AA7851F4646040199D2C88EA4AD12A3F094AA60BF8629BE9391C6EBC189F8744D9952AAAE68E91DA56F78471DE38C167D
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7d52a20d-ce11-437a-9768-5bca52e773b2.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):25053
                                                                                  Entropy (8bit):6.031348393488449
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:RMGQ7FCYXGIgtDAWtJ4v14Px9abyJh02tdg:RMGQ5XMB41kI
                                                                                  MD5:894365C43790B95C023F5906D47AFE64
                                                                                  SHA1:7680B2F8E26068FD1493192FDFD7B27D1EBFC417
                                                                                  SHA-256:378886E6E0B2A39ED92EDDFC8D3E5147BA172C9485DCA32A4A526F0646EEF019
                                                                                  SHA-512:0B222D5C89D4755E18B0A0F39A2E18C634A35AC249AB3BD43D93D3315BAFEBFABF923524C7CC45425EBC84446EA51FE16BB71309D3CA90A0BBC2A690230F83ED
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):107893
                                                                                  Entropy (8bit):4.640145133154881
                                                                                  Encrypted:false
                                                                                  SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
                                                                                  MD5:46BC3CA050C9032312C051408F8C6227
                                                                                  SHA1:4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
                                                                                  SHA-256:CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
                                                                                  SHA-512:BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
                                                                                  Malicious:false
                                                                                  Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\db968a8b-80ee-42dd-8447-0dc7f15c4243.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):107893
                                                                                  Entropy (8bit):4.640145133154881
                                                                                  Encrypted:false
                                                                                  SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
                                                                                  MD5:46BC3CA050C9032312C051408F8C6227
                                                                                  SHA1:4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
                                                                                  SHA-256:CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
                                                                                  SHA-512:BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
                                                                                  Malicious:false
                                                                                  Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):4194304
                                                                                  Entropy (8bit):0.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3::
                                                                                  MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                  SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                  SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                  SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):4194304
                                                                                  Entropy (8bit):0.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3::
                                                                                  MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                  SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                  SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                  SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D4D281-1C84.pma

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):4194304
                                                                                  Entropy (8bit):0.039620027214168414
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:7y01utmqvDzKX7LJ8iD12absbZHtgbXDh8IYhoPfNEl/9GRQM9mDnn8y08Tcm2Rl:G0EtClWCuh6goJmDn08T2RGOD
                                                                                  MD5:8051EFE49AFB20BDC3CD7B33069633E0
                                                                                  SHA1:EDD081AD6EDDA29797D131A2BCECB3C840EB621C
                                                                                  SHA-256:54E994519E2F7142D69DDD9F0856F2FDAC84D79C6A187A1FFFB90602680C9394
                                                                                  SHA-512:E682437622E7E09928ABC7133A3BA4CB038FBEB2064BBDFC3A446F0AD24834677EADD7FF4D9BF103ACF6C1F9B0690959ACA1ABD70F9B7C5D18791A55D1E705DC
                                                                                  Malicious:false
                                                                                  Preview:...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".drlddh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U.>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D4D282-1DCC.pma

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):4194304
                                                                                  Entropy (8bit):0.46402136258681576
                                                                                  Encrypted:false
                                                                                  SSDEEP:6144:nbYxF2UAWl25aHSMBWKxNYquWvxgIIaHlC:N6l2A1nZz
                                                                                  MD5:91400BA32B4294A76F4B04BBBB8A30C3
                                                                                  SHA1:BCF9BB0B7AC283C20BA43AD6E48D6778E04C8192
                                                                                  SHA-256:409694C616703AFF0DCEA55EE0D376294A388C71C06E9F9A494E5E7DEE16C2ED
                                                                                  SHA-512:7A7F2673057B64FED3DDEC91FB4C93A943A79C47198DC6D2BF964521959A0B3036AE32A5D8692976B00FAA6E54B6C010937D45A56145BB5AFA55AA251D6251FE
                                                                                  Malicious:false
                                                                                  Preview:...@..@...@.....C.].....@...................x...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".drlddh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U?:K..>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered....(..$...

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D4D294-648.pma

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):4194304
                                                                                  Entropy (8bit):0.04044595660644487
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:xl0EbtmqvDMKX2JLMo40QqpIg7XLIL0BKdjhaLNxJEnN1gQMvpEFn8y08Tcm2RGY:/0Etw4vsl+7hc4ngrpe08T2RGOD
                                                                                  MD5:5B9ED1625A09EC95D73CF5DC60798873
                                                                                  SHA1:96E7B57E08C8C685583D50BC017819F5173DC19C
                                                                                  SHA-256:DEA75267F48873A871A46C32294B7F39E6F93E5AEA57BC1F0FE51ECE29260149
                                                                                  SHA-512:D4A8DAA484C30EFC4BF9007D8A4A23C051340B2A12173B3F4D6F0BCAE3A0CD2BBCC4CB4328EB8687F2078B0B3A068CB0F0DE754CF46C8CF477764DEEF852405F
                                                                                  Malicious:false
                                                                                  Preview:...@..@...@.....C.].....@...............pa..(Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".drlddh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D4D29C-2558.pma

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):4194304
                                                                                  Entropy (8bit):0.03990470655723739
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:ww0EbtmqvD3KX7SJEa3Xxx7uqZGXPtg34khtbNE3oMO1gQpe3ep65ECn8y08TcmQ:X0EtHe18xphlIagwNp+H08T2RGOD
                                                                                  MD5:EA4D829A40F4382BFA33790A56DC35A6
                                                                                  SHA1:AC704A44D19655407B6AF3762E736BD8C86941AE
                                                                                  SHA-256:8B9B6BF9E88FCEF503533720275F6BE4BFCE9B99894A4E7EBA35647181C2E700
                                                                                  SHA-512:B20FCB0227D20D43D248712818B139D45E6CD3713C5EA0063AC240B47DDE9ED8E2779F22CF70BEFFDD5ABAEBDA3A2D8B981E7ADF5EDD2DD6B164AEEED1BFEA55
                                                                                  Malicious:false
                                                                                  Preview:...@..@...@.....C.].....@................`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".drlddh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):16384
                                                                                  Entropy (8bit):0.3553968406659012
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
                                                                                  MD5:CFAB81B800EDABACBF6CB61AA78D5258
                                                                                  SHA1:2730D4DA1BE7238D701DC84EB708A064B8D1CF27
                                                                                  SHA-256:452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
                                                                                  SHA-512:EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
                                                                                  Malicious:false
                                                                                  Preview:...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):280
                                                                                  Entropy (8bit):3.060980776278344
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
                                                                                  MD5:74B32A83C9311607EB525C6E23854EE0
                                                                                  SHA1:C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
                                                                                  SHA-256:06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
                                                                                  SHA-512:ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
                                                                                  Malicious:false
                                                                                  Preview:sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\27b34af7-1687-4e45-9b2b-23435c1a8753.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:very short file (no magic)
                                                                                  Category:dropped
                                                                                  Size (bytes):1
                                                                                  Entropy (8bit):0.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:L:L
                                                                                  MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                  SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                  SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                  SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                  Malicious:false
                                                                                  Preview:.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\639462a8-8809-412c-b0e0-ff93291d6748.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):9702
                                                                                  Entropy (8bit):4.952410886584107
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1aYm3N8clpj+FR0QA2u9+n1f:sVmFJF1YlpUeQfu9+
                                                                                  MD5:5103DF6C435F45796074D8AAF0BBC138
                                                                                  SHA1:B850B80900FE8CAFADB34AC752C39DAD413962F6
                                                                                  SHA-256:387D6B65D74CFDECB2145A4C770D28B368FA0638BC876BD3FA7D61856D221FC0
                                                                                  SHA-512:B2678B570AB1F3FEF06564ECA67FC9FF2DBC33805F9838ADD13FB7B8F71547192E1397AE0E15E93FAA6489E61D2A4DF057DD5A127845791CA992431412D68BFC
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7c8365a2-ca93-440a-b0e0-c3d886d09871.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):11061
                                                                                  Entropy (8bit):5.170897835375624
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1CjAWC/VYm3j8clpj+FR0QAA59+n1f:sVmFJF1uAWCvlpUeQh59+
                                                                                  MD5:C4ED6D2AE153CF949E52E11A34CDD448
                                                                                  SHA1:E0E643F8C116433A1BF95DBFADD85460FB476F43
                                                                                  SHA-256:627B767023800DE26B81D4E6BD9B43AA9B9EBD20404C032988D4CD30A2FE635A
                                                                                  SHA-512:FA13573D491F7557FE27713B18FE224C9CE555AE478025AFF4F50543803F0DAA0E9AB10B8789080C0EC64E1E5421B3341999B10332A6102286DFEE26BF4BFBFD
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7dbb1a26-a4c8-4009-bf75-a242f65f8eed.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):30210
                                                                                  Entropy (8bit):5.566177887486075
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:Z5Cnnd7pLGLvP+WPrvfSM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQ3cQyntrrwzFp2:Z5CnnLcvP+WPrvfSMu1jahcQKtgzytj
                                                                                  MD5:1725D363E704E5D809DF519E2DA426BF
                                                                                  SHA1:EE8BA43FB31DFD884ECB57F4EDA5995CBA15B75B
                                                                                  SHA-256:53D069CFB96903694C9C9044504B0BF4A3AA306B294734DDD96FFFDD3258EE0A
                                                                                  SHA-512:9C8B57326AADC49E1E37FB892AF03FEE8CC9AD86BBF0EDE9B8CB13DA81590750A8905A673B08FE1701E6A77E3463D94FD31E068F9E0F57F1661A37363966F2A6
                                                                                  Malicious:false
                                                                                  Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369697155130540","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369697155130540","location":5,"ma

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8f54943a-f268-4605-8e30-bdaeff07d1e1.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):10334
                                                                                  Entropy (8bit):5.072615075462016
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1CjAUYm3j8clpj+FR0QA2u9+n1f:sVmFJF1uAqlpUeQfu9+
                                                                                  MD5:F722911E3833F2AF62108AE634DAEBDB
                                                                                  SHA1:A5698EFA4B3FEDEC07872BC511929B584E426544
                                                                                  SHA-256:FCFED93487A26C24A8D7AFC5CECC00456B5E324EBF57EC035EA388E81B54A2AD
                                                                                  SHA-512:3DA47531ADC5C837C135C990AAA5E8366A8D77229F4CF6ABD499C820CA612EBE9BA6F25C1FCB8DD0DAB0E2AB7CD67B40EA1035864C3D6E231981481F8239E986
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:modified
                                                                                  Size (bytes):12991
                                                                                  Entropy (8bit):5.384802338505839
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:5AslAEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:CEAEOKSXs/J7mGnQmLu5/5eNdl
                                                                                  MD5:18B7A0E50018009ECFC27842B9B0305C
                                                                                  SHA1:21127F4193EAB489D7BD5C3216E934BDD805A7FB
                                                                                  SHA-256:05A03B1B57F9E1D5696B474CE7377AF989DE339F3FAF969DE8573D445BFD4CA4
                                                                                  SHA-512:41122B8326E3E66693794C9576D0B9AD4EF207407995E78C7134FFA47101AA01BEEDA2651FE42A5278C89D8324EDC05BB86D77AD7B9D9E7992FE77DEAE98C705
                                                                                  Malicious:false
                                                                                  Preview:...m.................DB_VERSION.1.>mH.................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13369697162387736.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}].^.9.................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7.*.13369697162388192.$QUERY:edge_hub_apps_manifest_gz4.7.*..[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]=_.../..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivileged

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):293
                                                                                  Entropy (8bit):5.078185020039669
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTN+tcmQB1wkn23oH+Tcwt9Eh1ZB2KLllVTNATOq2Pwkn23oH+Tcwt9Eh1tIFUv:P5N8gkfYeb9Eh1ZFLn5NATOvYfYeb9Ev
                                                                                  MD5:3CEE5AD0D0A33DEA53CDC03145732DD7
                                                                                  SHA1:88854102395A216B99D2B02AF907F0A7E4600BD4
                                                                                  SHA-256:17B79BF468CB3CC19E15B3750022B046D0066E786AA5ED2E4CF8CFE9C9BB5150
                                                                                  SHA-512:B3F2BCFC6E30FFE6D738F33D84D121F310DA809F324F326A476B5EA9B22003C03C03C109BD75C1881A72E4A7F3A59A5D2FB8A2507F111B1C0B3FB2BF20FEED3B
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:46:01.392 2100 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/09/01-16:46:01.489 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:OpenPGP Secret Key
                                                                                  Category:dropped
                                                                                  Size (bytes):41
                                                                                  Entropy (8bit):4.704993772857998
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                  MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                  SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                  SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                  SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                  Malicious:false
                                                                                  Preview:.|.."....leveldb.BytewiseComparator......

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                  Category:dropped
                                                                                  Size (bytes):12288
                                                                                  Entropy (8bit):0.3202460253800455
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
                                                                                  MD5:40B18EC43DB334E7B3F6295C7626F28D
                                                                                  SHA1:0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
                                                                                  SHA-256:85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
                                                                                  SHA-512:8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                  Category:dropped
                                                                                  Size (bytes):28672
                                                                                  Entropy (8bit):0.4651746238382649
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBNjK:TouQq3qh7z3bY2LNW9WMcUvBg
                                                                                  MD5:8B1CAF516CECBFB784CA5A6F7BA46D0F
                                                                                  SHA1:5CC77281E3D15B69C15D4E94063AF605368D3B3A
                                                                                  SHA-256:968C1A9BC0507608D34EEBAF9D210AAF74D2D8E6891945471331B0448A4F843B
                                                                                  SHA-512:9406E2268DC30486A454E9A55E785239473335711EB3E46FD343336D75773C6A190D7E3705FD430940E97456DD74A4A76AA22D07089DBC1D83888391332D0C1B
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.01057775872642915
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsFl:/F
                                                                                  MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                  SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                  SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                  SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                  Malicious:false
                                                                                  Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):270336
                                                                                  Entropy (8bit):8.280239615765425E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                  MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                  SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                  SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                  SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.011852361981932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsHlDll:/H
                                                                                  MD5:0962291D6D367570BEE5454721C17E11
                                                                                  SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                  SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                  SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.012340643231932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsGl3ll:/y
                                                                                  MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                  SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                  SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                  SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):262512
                                                                                  Entropy (8bit):9.553120663130604E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:LsNlQnl:Ls3Ql
                                                                                  MD5:251F8D3C28743BCC028350AD3DF24CED
                                                                                  SHA1:959C0F13BB56424B0BCE5953962A50D6D2AABEE8
                                                                                  SHA-256:BDA5E5540D04CC660A59CD72635ED37999BC488CB6BF3A7636848259CF15A146
                                                                                  SHA-512:617EEC0F4598330E5B56361CFA54B886146C8A2DF02D8C8C97CE566BA4D9FBA7155703F31918D41D6E24D9E574FB3CC1A1B47E498A59AAC470D777DF1A71B721
                                                                                  Malicious:false
                                                                                  Preview:..........................................1../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):33
                                                                                  Entropy (8bit):3.5394429593752084
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:iWstvhYNrkUn:iptAd
                                                                                  MD5:F27314DD366903BBC6141EAE524B0FDE
                                                                                  SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                                                  SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                                                  SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                                                  Malicious:false
                                                                                  Preview:...m.................DB_VERSION.1

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):305
                                                                                  Entropy (8bit):5.188016653977631
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTQvm81wkn23oH+TcwtnG2tbB2KLllVTQ1q2Pwkn23oH+TcwtnG2tMsIFUv:P5qmbfYebn9VFLn5yvYfYebn9GFUv
                                                                                  MD5:945C01217954EE6B5583A15B9F9A68A9
                                                                                  SHA1:1E63F8DB0DF859A87012835C5BB770EDA0BB44F0
                                                                                  SHA-256:7D3DFB803A8F4A6A68CBC9D8D80FF3FB53ECF45BEA1769F539AB4C74922396C1
                                                                                  SHA-512:AD75A445406B6122F0E97772F97AC94E83C7A338A5FA4D9ECEB5B5DD699CD5AD8E1709EC47B9F08EAE88ADD0604F99F824114508ECAE970DCFDA215F2D58117E
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:55.812 1ee0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/09/01-16:45:55.824 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:OpenPGP Secret Key
                                                                                  Category:dropped
                                                                                  Size (bytes):41
                                                                                  Entropy (8bit):4.704993772857998
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                  MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                  SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                  SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                  SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                  Malicious:false
                                                                                  Preview:.|.."....leveldb.BytewiseComparator......

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
                                                                                  Category:dropped
                                                                                  Size (bytes):32768
                                                                                  Entropy (8bit):0.494709561094235
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
                                                                                  MD5:CF7760533536E2AF66EA68BC3561B74D
                                                                                  SHA1:E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
                                                                                  SHA-256:E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
                                                                                  SHA-512:38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                                                  Category:dropped
                                                                                  Size (bytes):20480
                                                                                  Entropy (8bit):0.5094712832659277
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
                                                                                  MD5:D4971855DD087E30FC14DF1535B556B9
                                                                                  SHA1:9E00DEFC7E54C75163273184837B9D0263AA528C
                                                                                  SHA-256:EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
                                                                                  SHA-512:ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):375520
                                                                                  Entropy (8bit):5.354097250843116
                                                                                  Encrypted:false
                                                                                  SSDEEP:6144:QA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:QFdMyq49tEndBuHltBfdK5WNbsVEziPU
                                                                                  MD5:834824D008F7C3358C328C9A62305B9E
                                                                                  SHA1:787AFC6480D3D2935AF8234AC8B0FF6B63DBCA7E
                                                                                  SHA-256:0E8D1FD91583CE7871335C0C5F5A52CE7EFB836E8195E560E129B5558B6BF340
                                                                                  SHA-512:519AED3E916CD41F294EACC6CEFFEF138D26D6DBB36DBA582AA042DD6B6277982AF84033F5801E53E170869C1E6CE28674DFCE69A3F80D3718DC92AAB2AB28FE
                                                                                  Malicious:false
                                                                                  Preview:...m.................DB_VERSION.1.j.|q...............&QUERY_TIMESTAMP:domains_config_gz2.*.*.13369697162392669..QUERY:domains_config_gz2.*.*..[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):309
                                                                                  Entropy (8bit):5.183987692730459
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTNeQERM1wkn23oH+Tcwtk2WwnvB2KLllVTN2q2Pwkn23oH+Tcwtk2WwnvIFUv:P5NeRRrfYebkxwnvFLn5N2vYfYebkxwp
                                                                                  MD5:83D1EEE7C0893DE7D2872A5F1665A2F9
                                                                                  SHA1:8FFCB1A3046E713D88C3EEC03CE62A6348C7BFF3
                                                                                  SHA-256:CA7565300BEB47FF83396998328C29C5A5BD6E4466AB5E1703E4D2A0FBCCA71A
                                                                                  SHA-512:FFA679A3561EF75F324EF4749D2DED89CB0B81736948DB541F6D563F4A11C8A52F86D3522E7B36C0CF17979FCC7B44C02AF33B8CBF75BDB0AE81371768EA9009
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:46:01.435 2124 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/09/01-16:46:01.477 2124 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:OpenPGP Secret Key
                                                                                  Category:dropped
                                                                                  Size (bytes):41
                                                                                  Entropy (8bit):4.704993772857998
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                  MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                  SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                  SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                  SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                  Malicious:false
                                                                                  Preview:.|.."....leveldb.BytewiseComparator......

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:modified
                                                                                  Size (bytes):358860
                                                                                  Entropy (8bit):5.324613164604213
                                                                                  Encrypted:false
                                                                                  SSDEEP:6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RS:C1gAg1zfvK
                                                                                  MD5:B20AF8D708EDC37D55784AC68ECB13A0
                                                                                  SHA1:631E6CA482E7A3EA346D210FC6A29EE616C67A86
                                                                                  SHA-256:F1095F0049DF536D1E1482B19769F1A144D62B35AE5E747C8D4681E621B6084F
                                                                                  SHA-512:788133A3CBBDA1A62F863EC3F9E293E62C9334AFDA2F776AD317CB115A54E8A8EAD8F1C380BE9A5B44EE9634C6DA97161F738B4E60A84B376759074F451A881D
                                                                                  Malicious:false
                                                                                  Preview:{"aee_config":{"ar":{"price_regex":{"ae":"(((ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)))","dz":"(((dzd|da|\\x{062F}\\x{062C})\\s*\\d{1,3})|(\\d{1,3}\\s*(dzd|da|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}|egp)\\s*\\d{1,3})|(\\d{1,3}\\s*(e\\x{00a3}|egp)))","ma":"(((mad|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(mad|dhs|dh)))","sa":"((\\d{1,3}\\s*(sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633}))|((sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633})\\s*\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})|(\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):209
                                                                                  Entropy (8bit):1.8784775129881184
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                  MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                  SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                  SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                  SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                  Malicious:false
                                                                                  Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):281
                                                                                  Entropy (8bit):5.1627113043018715
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTQwE81wkn23oH+Tcwt8aVdg2KLllVTQJPAvIq2Pwkn23oH+Tcwt8aPrqIFUv:P55EbfYeb0Ln5E4AvYfYebL3FUv
                                                                                  MD5:56E7CCCB2F320ACF40BB426A2F149565
                                                                                  SHA1:0B064C4A7182F792EB62328E235A6DDC0DA8936A
                                                                                  SHA-256:AF7ED8F4FD3E9D78BFA1C6C94B7B16E6E1C7C4E4A3766D0E596E858451CABD89
                                                                                  SHA-512:B0392D55281C8D0D6E89EC4DDDC2E34B2715DE5682623150892D77D782AE4C5EC40AD7B3A833971F37C7DCB649088B0444BB2FAEF54DB46363C5E7C0FDCBC0EB
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:55.826 1ee0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/09/01-16:45:55.835 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:OpenPGP Secret Key
                                                                                  Category:dropped
                                                                                  Size (bytes):41
                                                                                  Entropy (8bit):4.704993772857998
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                  MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                  SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                  SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                  SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                  Malicious:false
                                                                                  Preview:.|.."....leveldb.BytewiseComparator......

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):209
                                                                                  Entropy (8bit):1.8784775129881184
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                  MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                  SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                  SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                  SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                  Malicious:false
                                                                                  Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):285
                                                                                  Entropy (8bit):5.135840470508131
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTQcUQ+vm81wkn23oH+Tcwt86FB2KLllVTmCZAAq2Pwkn23oH+Tcwt865IFUv:P5h++bfYeb/FFLn5zvYfYeb/WFUv
                                                                                  MD5:A5EBCEEF04B02EB91194E69718BA2554
                                                                                  SHA1:C79AD0D118D6A999DEBFFA7EB23FB7B0D4FD0CCC
                                                                                  SHA-256:D5911ADED3D3AACAC7F218EAD2F85F1BC8B3FD5C7DA52B66F708CB6920E544AB
                                                                                  SHA-512:B577E67FAFE948AC6C4C62083FE375158DBA1CE658B4F5BFA00237719F4AE7D703E5CEE5235F96175BD96EF661C30586839E9DBD92FCB46C887B9C8AF3AE2996
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:55.915 1ee0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/09/01-16:45:56.213 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:OpenPGP Secret Key
                                                                                  Category:dropped
                                                                                  Size (bytes):41
                                                                                  Entropy (8bit):4.704993772857998
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                  MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                  SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                  SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                  SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                  Malicious:false
                                                                                  Preview:.|.."....leveldb.BytewiseComparator......

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):1197
                                                                                  Entropy (8bit):1.8784775129881184
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                  MD5:A2A3B1383E3AAC2430F44FC7BF3E447E
                                                                                  SHA1:B807210A1205126A107A5FE25F070D2879407AA4
                                                                                  SHA-256:90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
                                                                                  SHA-512:396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
                                                                                  Malicious:false
                                                                                  Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):322
                                                                                  Entropy (8bit):5.221329773515273
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTqbOq2Pwkn23oH+Tcwt8NIFUt82VTqfFZmZZmw+2VT2mzkwOwkn23oH+Tcwt8n:P5qCvYfYebpFUt825qfPmZ/+252u5JfO
                                                                                  MD5:19160EF35323AFA5E2E69E7D25958A61
                                                                                  SHA1:8013D955C82846CDF84B08766555A0358DCCCE52
                                                                                  SHA-256:D27A3434EB9508E87A6B2F3387BF94FE9D3DA080F79A1A4EE15FB2B69795ED0F
                                                                                  SHA-512:4B4E6FBB9924AF388CA0B58ABD9AED15E9B8D8D03DFF7069E8F355AD0BAC97E5C397F9FA13535A8F503D295237A2060B995267623204DF0E37B759479D2212B7
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.587 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/01-16:45:56.588 1e74 Recovering log #3.2024/09/01-16:45:56.601 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):322
                                                                                  Entropy (8bit):5.221329773515273
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTqbOq2Pwkn23oH+Tcwt8NIFUt82VTqfFZmZZmw+2VT2mzkwOwkn23oH+Tcwt8n:P5qCvYfYebpFUt825qfPmZ/+252u5JfO
                                                                                  MD5:19160EF35323AFA5E2E69E7D25958A61
                                                                                  SHA1:8013D955C82846CDF84B08766555A0358DCCCE52
                                                                                  SHA-256:D27A3434EB9508E87A6B2F3387BF94FE9D3DA080F79A1A4EE15FB2B69795ED0F
                                                                                  SHA-512:4B4E6FBB9924AF388CA0B58ABD9AED15E9B8D8D03DFF7069E8F355AD0BAC97E5C397F9FA13535A8F503D295237A2060B995267623204DF0E37B759479D2212B7
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.587 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/01-16:45:56.588 1e74 Recovering log #3.2024/09/01-16:45:56.601 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                  Category:dropped
                                                                                  Size (bytes):4096
                                                                                  Entropy (8bit):0.3169096321222068
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
                                                                                  MD5:2554AD7847B0D04963FDAE908DB81074
                                                                                  SHA1:F84ABD8D05D7B0DFB693485614ECF5204989B74A
                                                                                  SHA-256:F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
                                                                                  SHA-512:13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                  Category:dropped
                                                                                  Size (bytes):32768
                                                                                  Entropy (8bit):0.40981274649195937
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
                                                                                  MD5:1A7F642FD4F71A656BE75B26B2D9ED79
                                                                                  SHA1:51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
                                                                                  SHA-256:B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
                                                                                  SHA-512:FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):429
                                                                                  Entropy (8bit):5.809210454117189
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
                                                                                  MD5:5D1D9020CCEFD76CA661902E0C229087
                                                                                  SHA1:DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
                                                                                  SHA-256:B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
                                                                                  SHA-512:5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
                                                                                  Malicious:false
                                                                                  Preview:{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                  Category:dropped
                                                                                  Size (bytes):20480
                                                                                  Entropy (8bit):2.4460892950555673
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:0BCyvkTLWfVHelS9nsH4/AztcFuuoKwxTLWCk:mNvkevsHXzCFPo1xQ
                                                                                  MD5:4FAB9C1D1CF74D1C214122DA6D7B7179
                                                                                  SHA1:240AF46542E3517F9788F4590CF24475EC2256F3
                                                                                  SHA-256:AD231B1DC5AF3DFEEE088342FD74A70B7B6CDB0D7ADF5F103D9A0055641E8A8A
                                                                                  SHA-512:4353A190BE3727A2D85061E29AF143640C44EA8AA5D0E5264BE15484D6069FE46743416C364DDE7DE3F2FB50D8A04D29ED837773B3A36CBC9B5F4DF5C1D73C2C
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 4
                                                                                  Category:dropped
                                                                                  Size (bytes):159744
                                                                                  Entropy (8bit):0.6461031130037994
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:dTLWLu1xU+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjNCRwuTTLWb:d/0+GPXBBE3upb0HtTTDxVj6wuT
                                                                                  MD5:D43EDD54C623DA8598FFD74A3578F909
                                                                                  SHA1:605DDF1BDA68387A57EFBFB239D721294CA12A77
                                                                                  SHA-256:C16145F8440A1A755AB5A47EF5AC42B91722474F87171E764346E721F1C7A88E
                                                                                  SHA-512:FD7F131F4B7A6A2B64572233B184E233F69A2970445AAA9E42DC168F3053F0263254D125B1D2511CE4C442502DE04937E19F511CC11C018D7439E61DE53CB193
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8720
                                                                                  Entropy (8bit):0.3280418307051851
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:mIFA/J3+t76Y4QZZofU99pO0BYX+TqR4EZY4QZvGQ:mLhHQws9LdVmBQZGQ
                                                                                  MD5:B9E6F65D06E2CAC4DA8ADE2950E56076
                                                                                  SHA1:4080C4098DD650F9F8B49BE092F68206CEF04760
                                                                                  SHA-256:92F4E1F95F72056162AE00E85D42E090A78F6FB2AB86FA573B45482EA98BC8BB
                                                                                  SHA-512:A3B3EEC567968CE0D490F31C0F39309E2D3B0604D1FD600E670FAFDC2CC84018F079A1BD00FADE9678716D8E82D7CFE2CBBD3E9552FDCDC2C8DEA682878A30AE
                                                                                  Malicious:false
                                                                                  Preview:.............1....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
                                                                                  Category:dropped
                                                                                  Size (bytes):28672
                                                                                  Entropy (8bit):0.33890226319329847
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
                                                                                  MD5:971F4C153D386AC7ED39363C31E854FC
                                                                                  SHA1:339841CA0088C9EABDE4AACC8567D2289CCB9544
                                                                                  SHA-256:B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
                                                                                  SHA-512:1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):406
                                                                                  Entropy (8bit):5.293494973878197
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:P5tDM+vYfYeb8rcHEZrELFUt825tg/+25cDMV5JfYeb8rcHEZrEZSJ:BPYfYeb8nZrExg8AcJJfYeb8nZrEZe
                                                                                  MD5:E46F8B940DA3E5680975ABBC772228A8
                                                                                  SHA1:DFA5870D786406E0D8B4F2DCDD6F502134D4E8DD
                                                                                  SHA-256:BE323EBF1318B3AEBBC73252F59CFF2F9FF0EB56D42247187E4D5C1E4914D1B3
                                                                                  SHA-512:90E3EF533925A422FBD40C8D7CFA9179DC076D24170DA8F5534C3F1432B077861BF4001842866908BBF84C4B9A2509FDD754368F3EAC07FFDDB3E3FE4D6C4F33
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:58.330 1e6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/01-16:45:58.330 1e6c Recovering log #3.2024/09/01-16:45:58.331 1e6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):406
                                                                                  Entropy (8bit):5.293494973878197
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:P5tDM+vYfYeb8rcHEZrELFUt825tg/+25cDMV5JfYeb8rcHEZrEZSJ:BPYfYeb8nZrExg8AcJJfYeb8nZrEZe
                                                                                  MD5:E46F8B940DA3E5680975ABBC772228A8
                                                                                  SHA1:DFA5870D786406E0D8B4F2DCDD6F502134D4E8DD
                                                                                  SHA-256:BE323EBF1318B3AEBBC73252F59CFF2F9FF0EB56D42247187E4D5C1E4914D1B3
                                                                                  SHA-512:90E3EF533925A422FBD40C8D7CFA9179DC076D24170DA8F5534C3F1432B077861BF4001842866908BBF84C4B9A2509FDD754368F3EAC07FFDDB3E3FE4D6C4F33
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:58.330 1e6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/01-16:45:58.330 1e6c Recovering log #3.2024/09/01-16:45:58.331 1e6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):334
                                                                                  Entropy (8bit):5.223503679169904
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVToIM+q2Pwkn23oH+Tcwt8a2jMGIFUt82VTowZmw+2VTo1uqMVkwOwkn23oH+Tg:P5LM+vYfYeb8EFUt825V/+252BMV5Jfo
                                                                                  MD5:188DFA1EC4A36692F7DF2DD5A9EA6CB0
                                                                                  SHA1:0A709869EC1F96320C7C7C2A808F60050F86DA3E
                                                                                  SHA-256:1691B9E67478E8AF9A1FFBE5200056EC807B6FD6E88A32A6C5AECD25BDB20E4B
                                                                                  SHA-512:306EEA2DB9FB9EDF97A2FAAEF44C0F715D0EFA4AE1A339961021FFC2955439AB41F395F622FBA88B51F091C3AA1314E4082ADBE282165713EEF5BD53588821DC
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.717 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/01-16:45:56.718 1ffc Recovering log #3.2024/09/01-16:45:56.721 1ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):334
                                                                                  Entropy (8bit):5.223503679169904
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVToIM+q2Pwkn23oH+Tcwt8a2jMGIFUt82VTowZmw+2VTo1uqMVkwOwkn23oH+Tg:P5LM+vYfYeb8EFUt825V/+252BMV5Jfo
                                                                                  MD5:188DFA1EC4A36692F7DF2DD5A9EA6CB0
                                                                                  SHA1:0A709869EC1F96320C7C7C2A808F60050F86DA3E
                                                                                  SHA-256:1691B9E67478E8AF9A1FFBE5200056EC807B6FD6E88A32A6C5AECD25BDB20E4B
                                                                                  SHA-512:306EEA2DB9FB9EDF97A2FAAEF44C0F715D0EFA4AE1A339961021FFC2955439AB41F395F622FBA88B51F091C3AA1314E4082ADBE282165713EEF5BD53588821DC
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.717 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/01-16:45:56.718 1ffc Recovering log #3.2024/09/01-16:45:56.721 1ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
                                                                                  Category:dropped
                                                                                  Size (bytes):57344
                                                                                  Entropy (8bit):0.863060653641558
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
                                                                                  MD5:C681C90B3AAD7F7E4AF8664DE16971DF
                                                                                  SHA1:9F72588CEA6569261291B19E06043A1EFC3653BC
                                                                                  SHA-256:ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
                                                                                  SHA-512:4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                  Category:dropped
                                                                                  Size (bytes):45056
                                                                                  Entropy (8bit):0.40293591932113104
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
                                                                                  MD5:ADC0CFB8A1A20DE2C4AB738B413CBEA4
                                                                                  SHA1:238EF489E5FDC6EBB36F09D415FB353350E7097B
                                                                                  SHA-256:7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
                                                                                  SHA-512:38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\00f090c2-abe6-481b-b95e-86e39a2a9171.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):355
                                                                                  Entropy (8bit):5.4716386588308366
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sXQcu33lBv31dB8wXwlmUUAnIMp5tSQ:YWyX5Sg9vt+UAnIQcu33lR7N+UAnI5Q
                                                                                  MD5:26C13089A8BBF9C6ADE40AC7CE6C3DB8
                                                                                  SHA1:3A1DC87D3BFF532C267EFCBB0C9DB53066AB7C24
                                                                                  SHA-256:7EC7C8455638C78AD9F1D10F654A14F2C335749BDE3FAAA284F3985F4C5BC13E
                                                                                  SHA-512:916EE96CD75160BE6DE3368806FF7C130C769236EF0A6E80D1DC66146F47C44E8FEFCDAEC5A9CD920425523FFC5D78D798BE887434F6DC339D8AF7ADB25DE83B
                                                                                  Malicious:false
                                                                                  Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702},{"expiry":1756759567.517838,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1725223567.517843}],"version":2}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1e24ebc4-23cb-4cff-825a-f68a4a5eacc9.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5375ead1-407f-49d4-b88b-1763db4a64e2.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2271
                                                                                  Entropy (8bit):5.277291857995472
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YXsg8sN1fcdsngsXrsrJgnslz+HppsZeWYswV+HTesiCxbZ:Y/rfA5z4pKlQV4YA1
                                                                                  MD5:7BB343CE46138F731A5A86F921DD139F
                                                                                  SHA1:85ACB1125E11CBCB503F8031B9C33BAE3479288D
                                                                                  SHA-256:090A18131B5AEDEF82EC43E603FA35EA7923511BFAAE3FF8375456E9B42D9DD6
                                                                                  SHA-512:24B719B09DB3E995C70F1D0DD1797FFA7E1FE7CBD766DA7B4DDDBCC96A4FFC49C1EBC9EC1C498867688819A649BB88FD6C45949190FC8CDAE0A1D1FC248AF1E9
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372289159692180","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372289160843859","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372289162114076","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372289166418303","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://www.google.com"},{"alternative_service":[{"adver

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\59cfb704-dfd2-4c2e-8785-c489d91dc673.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e1fd090-86b0-4100-9183-f3cef05fa43a.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
                                                                                  Category:dropped
                                                                                  Size (bytes):20480
                                                                                  Entropy (8bit):1.0860249556558599
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:T2dKLopF+SawLUO1Xj8BFICuOeL+Y47OFyPr:ige+AuU4lr
                                                                                  MD5:265201B4F315A6759D843D2ECD292739
                                                                                  SHA1:E841B343E7F2E35B7AB9CE4EDF8F111E2EFFEA88
                                                                                  SHA-256:A226B4E0A90022D108030BA8AFD4EE76B518006057AFE30C91D135F3B1138367
                                                                                  SHA-512:75494D6F8AAEDA71E395A50F938354806053D1AB38054EC0EC9348B1932C200FF3C1B9FA92BE2208F8F1FD98B8E6015EF725E8AC905FAF41A9DC252C6C080D80
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):61
                                                                                  Entropy (8bit):3.926136109079379
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                  MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                  SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                  SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                  SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2c70f.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):61
                                                                                  Entropy (8bit):3.926136109079379
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                  MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                  SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                  SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                  SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3b17e.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):61
                                                                                  Entropy (8bit):3.926136109079379
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                  MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                  SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                  SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                  SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                                                  Category:dropped
                                                                                  Size (bytes):36864
                                                                                  Entropy (8bit):1.3301221610885812
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:uIEumQv8m1ccnvS63Do2dQF2YQ9UZam1y8woLQQRVkI:uIEumQv8m1ccnvS68282rUZamE8wCvd
                                                                                  MD5:4634EF0FCC210359A6DDFE7B2B58325F
                                                                                  SHA1:29D4C3A78E4A9792DEC5A52D6B2E341703807C7A
                                                                                  SHA-256:A0A10A57C37A61A4A72E79351B7978E448AD65F78A7ABB725B4C0D2C1C51CF1A
                                                                                  SHA-512:42584EA3D89522727B47F00E86323152E50C0E72D732D0D235992263795E3494A11984882DACC0FF14002F52DB48DBC38DC14B9C8CC06C1588AC39419B995705
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a483.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2b9ef.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):40
                                                                                  Entropy (8bit):4.1275671571169275
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                  MD5:20D4B8FA017A12A108C87F540836E250
                                                                                  SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                  SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                  SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                  Malicious:false
                                                                                  Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):203
                                                                                  Entropy (8bit):5.4042796420747425
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                  MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                  SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                  SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                  SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                  Malicious:false
                                                                                  Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2c70f.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):203
                                                                                  Entropy (8bit):5.4042796420747425
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                  MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                  SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                  SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                  SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                  Malicious:false
                                                                                  Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3c44b.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):203
                                                                                  Entropy (8bit):5.4042796420747425
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                  MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                  SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                  SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                  SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                  Malicious:false
                                                                                  Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                  Category:dropped
                                                                                  Size (bytes):36864
                                                                                  Entropy (8bit):0.36515621748816035
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                  MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                  SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                  SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                  SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c7a0caf0-a9e6-4e33-bf97-2877ae6701e9.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):111
                                                                                  Entropy (8bit):4.718418993774295
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                  MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                  SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                  SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                  SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1e77ef0-e0ba-4bfc-a832-0e33e458c56c.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):354
                                                                                  Entropy (8bit):5.456823236830331
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sXQcuTX4XBv31dB8wXwlmUUAnIMp5DWSQ:YWyX5Sg9vt+UAnIQcuTX4XR7N+UAnIKO
                                                                                  MD5:07DA7C1F16B434E47B7239000ECE7D81
                                                                                  SHA1:2F055784B7D4344E10026C11FAD48A5B5CFEC6F4
                                                                                  SHA-256:BA117EE6C1D1F6860E74F4DD3057FA5C89D57CB49D543C692398EF847B06DAE5
                                                                                  SHA-512:9FE1700E3AD6872020B0B0CFEB9F78CD77C34A0DB866613DD67AF4C6B43960889745A15C6F318562708ECBC40B9BA1698C49D1943C8A5C10E715829A650AD6BC
                                                                                  Malicious:false
                                                                                  Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702},{"expiry":1756759627.525615,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1725223627.52562}],"version":2}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd009265-f789-4515-9f9b-8ea57713b726.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):40
                                                                                  Entropy (8bit):4.1275671571169275
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                  MD5:20D4B8FA017A12A108C87F540836E250
                                                                                  SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                  SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                  SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                  Malicious:false
                                                                                  Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                  Category:dropped
                                                                                  Size (bytes):20480
                                                                                  Entropy (8bit):0.5744102022039023
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isCHIrdNG7fdjxHIXOFSY:TLiOUOq0afDdWec9sJKG7zo7J5fc
                                                                                  MD5:8B7CCBAE5FB8F1D3FDB331AED0833FB0
                                                                                  SHA1:7924CE8D7CF818F1132F1C8A047FBEEF13F18877
                                                                                  SHA-256:8029C4EAA75734867C5970AB41422A7F551EBFDF65E152C09F8A4038B17080C8
                                                                                  SHA-512:23B07F98E037ECC9BAAB37EA93264503B936CA180F4873D19944D186F3529926CBDC7A0962E7A51EADC8CEB2CA85D94BFC3C431D0068B8320C45BF24C0DDB163
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):9702
                                                                                  Entropy (8bit):4.952410886584107
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1aYm3N8clpj+FR0QA2u9+n1f:sVmFJF1YlpUeQfu9+
                                                                                  MD5:5103DF6C435F45796074D8AAF0BBC138
                                                                                  SHA1:B850B80900FE8CAFADB34AC752C39DAD413962F6
                                                                                  SHA-256:387D6B65D74CFDECB2145A4C770D28B368FA0638BC876BD3FA7D61856D221FC0
                                                                                  SHA-512:B2678B570AB1F3FEF06564ECA67FC9FF2DBC33805F9838ADD13FB7B8F71547192E1397AE0E15E93FAA6489E61D2A4DF057DD5A127845791CA992431412D68BFC
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2e3af.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):9702
                                                                                  Entropy (8bit):4.952410886584107
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1aYm3N8clpj+FR0QA2u9+n1f:sVmFJF1YlpUeQfu9+
                                                                                  MD5:5103DF6C435F45796074D8AAF0BBC138
                                                                                  SHA1:B850B80900FE8CAFADB34AC752C39DAD413962F6
                                                                                  SHA-256:387D6B65D74CFDECB2145A4C770D28B368FA0638BC876BD3FA7D61856D221FC0
                                                                                  SHA-512:B2678B570AB1F3FEF06564ECA67FC9FF2DBC33805F9838ADD13FB7B8F71547192E1397AE0E15E93FAA6489E61D2A4DF057DD5A127845791CA992431412D68BFC
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF317bf.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):9702
                                                                                  Entropy (8bit):4.952410886584107
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1aYm3N8clpj+FR0QA2u9+n1f:sVmFJF1YlpUeQfu9+
                                                                                  MD5:5103DF6C435F45796074D8AAF0BBC138
                                                                                  SHA1:B850B80900FE8CAFADB34AC752C39DAD413962F6
                                                                                  SHA-256:387D6B65D74CFDECB2145A4C770D28B368FA0638BC876BD3FA7D61856D221FC0
                                                                                  SHA-512:B2678B570AB1F3FEF06564ECA67FC9FF2DBC33805F9838ADD13FB7B8F71547192E1397AE0E15E93FAA6489E61D2A4DF057DD5A127845791CA992431412D68BFC
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF350a2.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):9702
                                                                                  Entropy (8bit):4.952410886584107
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1aYm3N8clpj+FR0QA2u9+n1f:sVmFJF1YlpUeQfu9+
                                                                                  MD5:5103DF6C435F45796074D8AAF0BBC138
                                                                                  SHA1:B850B80900FE8CAFADB34AC752C39DAD413962F6
                                                                                  SHA-256:387D6B65D74CFDECB2145A4C770D28B368FA0638BC876BD3FA7D61856D221FC0
                                                                                  SHA-512:B2678B570AB1F3FEF06564ECA67FC9FF2DBC33805F9838ADD13FB7B8F71547192E1397AE0E15E93FAA6489E61D2A4DF057DD5A127845791CA992431412D68BFC
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF39cdd.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):9702
                                                                                  Entropy (8bit):4.952410886584107
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1aYm3N8clpj+FR0QA2u9+n1f:sVmFJF1YlpUeQfu9+
                                                                                  MD5:5103DF6C435F45796074D8AAF0BBC138
                                                                                  SHA1:B850B80900FE8CAFADB34AC752C39DAD413962F6
                                                                                  SHA-256:387D6B65D74CFDECB2145A4C770D28B368FA0638BC876BD3FA7D61856D221FC0
                                                                                  SHA-512:B2678B570AB1F3FEF06564ECA67FC9FF2DBC33805F9838ADD13FB7B8F71547192E1397AE0E15E93FAA6489E61D2A4DF057DD5A127845791CA992431412D68BFC
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):33
                                                                                  Entropy (8bit):4.051821770808046
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YVXADAEvTLSJ:Y9AcEvHSJ
                                                                                  MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                                                  SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                                                  SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                                                  SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                                                  Malicious:false
                                                                                  Preview:{"preferred_apps":[],"version":1}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):25012
                                                                                  Entropy (8bit):5.5677754919671125
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:Z5CnE+WPrvf1M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPyntrrwwp+tuK:Z5CnE+WPrvf1Mu1jaeKtgpt9
                                                                                  MD5:C8D0241611959794CB53562D8D69F3AF
                                                                                  SHA1:216A3DFE7C0FFA96D2AE0C3D6B08E5F83E56D721
                                                                                  SHA-256:9B19FF3882E2B9FB474EC3B22DDEB083C7618583990C1A409D97D69F3C983A7D
                                                                                  SHA-512:AA47B88C2AA6EC28164E7177AAB6E165E99B485E88DCF5E26ACEF3769403CD37F87AF7F1D136D2A9CDA5C6C901F934984706C0119AD5B9E3DED08C012354CC9B
                                                                                  Malicious:false
                                                                                  Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369697155130540","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369697155130540","location":5,"ma

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2e10f.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):25012
                                                                                  Entropy (8bit):5.5677754919671125
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:Z5CnE+WPrvf1M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPyntrrwwp+tuK:Z5CnE+WPrvf1Mu1jaeKtgpt9
                                                                                  MD5:C8D0241611959794CB53562D8D69F3AF
                                                                                  SHA1:216A3DFE7C0FFA96D2AE0C3D6B08E5F83E56D721
                                                                                  SHA-256:9B19FF3882E2B9FB474EC3B22DDEB083C7618583990C1A409D97D69F3C983A7D
                                                                                  SHA-512:AA47B88C2AA6EC28164E7177AAB6E165E99B485E88DCF5E26ACEF3769403CD37F87AF7F1D136D2A9CDA5C6C901F934984706C0119AD5B9E3DED08C012354CC9B
                                                                                  Malicious:false
                                                                                  Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369697155130540","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369697155130540","location":5,"ma

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF31406.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):25012
                                                                                  Entropy (8bit):5.5677754919671125
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:Z5CnE+WPrvf1M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPyntrrwwp+tuK:Z5CnE+WPrvf1Mu1jaeKtgpt9
                                                                                  MD5:C8D0241611959794CB53562D8D69F3AF
                                                                                  SHA1:216A3DFE7C0FFA96D2AE0C3D6B08E5F83E56D721
                                                                                  SHA-256:9B19FF3882E2B9FB474EC3B22DDEB083C7618583990C1A409D97D69F3C983A7D
                                                                                  SHA-512:AA47B88C2AA6EC28164E7177AAB6E165E99B485E88DCF5E26ACEF3769403CD37F87AF7F1D136D2A9CDA5C6C901F934984706C0119AD5B9E3DED08C012354CC9B
                                                                                  Malicious:false
                                                                                  Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369697155130540","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369697155130540","location":5,"ma

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):364
                                                                                  Entropy (8bit):4.021862004671385
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:S85aEFljljljljljljlaWmPZXlaDQ02M6zXC3nw+CA5EEE:S+a8ljljljljljljlazUQ02M6T+CA
                                                                                  MD5:AFB420AF907A86223B3654EBC08C4DD1
                                                                                  SHA1:959C252F72E03191DBB6AC022404A238B9B5F4EA
                                                                                  SHA-256:B4A1832B1D04BC1639E659AE6F1F1854FB1C1D2074D4A650B29A3BE12D5844D9
                                                                                  SHA-512:5A1634B8278D6051F6FC15673655DAE2A5BEAC4F4150AAAE8D79C86AF285998696C97654B7C5747F608DACE26713E653C92E5668682EFD78B359F0257BE8F70A
                                                                                  Malicious:false
                                                                                  Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................3.j................next-map-id.1.Knamespace-9523f89b_704d_45a4_a3c2_7ed2dbf5f7a1-https://accounts.google.com/.0V.e................V.e................V.e................V.e................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):322
                                                                                  Entropy (8bit):5.198374473283517
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTy2mM+q2Pwkn23oH+TcwtrQMxIFUt82VTy6qZmw+2VTonmMVkwOwkn23oH+TcM:P5qM+vYfYebCFUt825bq/+25lMV5JfYM
                                                                                  MD5:578D3D6863C5D6F30692D3B1841043B7
                                                                                  SHA1:659856E6E3BB98FBF5E304C87FE872667733B784
                                                                                  SHA-256:36ED7E6A37735535CF237D098E7F75B541235544C92D2BC019DBFEDA1776BB2A
                                                                                  SHA-512:AC38EB79FC633AF3F669F7D02C0BF6D7BC376D1A49E84D95B00B8CD171B925FD0D4B15240229546E0410829BDA17B0CDE223ACA9DE73B49E894DFB048BA77A6E
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.697 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/01-16:45:56.698 1ffc Recovering log #3.2024/09/01-16:45:56.702 1ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):322
                                                                                  Entropy (8bit):5.198374473283517
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTy2mM+q2Pwkn23oH+TcwtrQMxIFUt82VTy6qZmw+2VTonmMVkwOwkn23oH+TcM:P5qM+vYfYebCFUt825bq/+25lMV5JfYM
                                                                                  MD5:578D3D6863C5D6F30692D3B1841043B7
                                                                                  SHA1:659856E6E3BB98FBF5E304C87FE872667733B784
                                                                                  SHA-256:36ED7E6A37735535CF237D098E7F75B541235544C92D2BC019DBFEDA1776BB2A
                                                                                  SHA-512:AC38EB79FC633AF3F669F7D02C0BF6D7BC376D1A49E84D95B00B8CD171B925FD0D4B15240229546E0410829BDA17B0CDE223ACA9DE73B49E894DFB048BA77A6E
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.697 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/01-16:45:56.698 1ffc Recovering log #3.2024/09/01-16:45:56.702 1ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13369697157603689

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):7469
                                                                                  Entropy (8bit):4.039124615958264
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:3o59o+3Pr/9OpcVoI3Pr/9OpWCeY2J3Pr/9OpscMyh:LOLcp7ILcprkLcpVM
                                                                                  MD5:F8DE936265DFE1A928540771C9B15978
                                                                                  SHA1:0A64A20A4B76CD4081AC67DF00A94AA0896A231A
                                                                                  SHA-256:255E95B14BC2A4BCBAEC90266D6AB0CFE96F1F30C1BE8241B9324A7E7EC60108
                                                                                  SHA-512:CC7B333048CD79AD08411B42C335FA79B17AFEBD1F29987B990E44BAFA98F3007633A9D5B7A481E9F295FF536D142B8F9EA305BB4887D934E8398064FCA827D1
                                                                                  Malicious:false
                                                                                  Preview:SNSS.........\G.............\G......"..\G.............\G.........\G.........\G.........\G....!....\G.................................\G..\G1..,.....\G$...9523f89b_704d_45a4_a3c2_7ed2dbf5f7a1.....\G.........\G....W}...........\G.....\G.........................\G.........................\G....................5..0.....\G&...{1A5CCF63-1000-409F-B5C1-AFEC7F75D4D9}.......\G............\G.............\G....>...https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd&ifkv=Ab5oB3qKM_iPl-MS-i1URCgCEjZYROBp2L3dePkdlz7-MOALa1wL7sYbxs6fmYLskYBnuxUvo4DUqw&service=accountsettings&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1678103009%3A1725223561347173&ddm=1......S.i.g.n. .i.n. .-. .G.o.o.g.l.e. .A.c.c.o.u.n.t.s...L...H...!...@.......................................................................................................!......!..................................P...................................................>...h

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                  Category:dropped
                                                                                  Size (bytes):20480
                                                                                  Entropy (8bit):0.44194574462308833
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
                                                                                  MD5:B35F740AA7FFEA282E525838EABFE0A6
                                                                                  SHA1:A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
                                                                                  SHA-256:5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
                                                                                  SHA-512:05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):350
                                                                                  Entropy (8bit):5.1626497625902115
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTQScWF3q2Pwkn23oH+Tcwt7Uh2ghZIFUt82VTQScWFaZmw+2VTQScWFmkwOwkr:P5HcC3vYfYebIhHh2FUt825HcCa/+25v
                                                                                  MD5:A972F030B0A205B62A6488AB0CF88C92
                                                                                  SHA1:B839296DE8FA3C37CAFE5994E303BD8ABADFA2FF
                                                                                  SHA-256:B08A0B209A665638BCA7D8162E12C0C7E859ED92DDC0A6D9C9D7E1B5DB79E3A3
                                                                                  SHA-512:EBE3808EAF0DBDF1088D79FAFF060AB84547ADAF6E5CE36DA378A4643CDFF378FFF88BFB290E99F4D89C35680FD5AAD906C48991ADE30188778D70B31B991E39
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:55.793 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/01-16:45:55.793 1ee0 Recovering log #3.2024/09/01-16:45:55.793 1ee0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):350
                                                                                  Entropy (8bit):5.1626497625902115
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTQScWF3q2Pwkn23oH+Tcwt7Uh2ghZIFUt82VTQScWFaZmw+2VTQScWFmkwOwkr:P5HcC3vYfYebIhHh2FUt825HcCa/+25v
                                                                                  MD5:A972F030B0A205B62A6488AB0CF88C92
                                                                                  SHA1:B839296DE8FA3C37CAFE5994E303BD8ABADFA2FF
                                                                                  SHA-256:B08A0B209A665638BCA7D8162E12C0C7E859ED92DDC0A6D9C9D7E1B5DB79E3A3
                                                                                  SHA-512:EBE3808EAF0DBDF1088D79FAFF060AB84547ADAF6E5CE36DA378A4643CDFF378FFF88BFB290E99F4D89C35680FD5AAD906C48991ADE30188778D70B31B991E39
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:55.793 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/01-16:45:55.793 1ee0 Recovering log #3.2024/09/01-16:45:55.793 1ee0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.01057775872642915
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsFl:/F
                                                                                  MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                  SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                  SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                  SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                  Malicious:false
                                                                                  Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):270336
                                                                                  Entropy (8bit):8.280239615765425E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                  MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                  SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                  SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                  SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.011852361981932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsHlDll:/H
                                                                                  MD5:0962291D6D367570BEE5454721C17E11
                                                                                  SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                  SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                  SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.012340643231932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsGl3ll:/y
                                                                                  MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                  SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                  SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                  SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):524656
                                                                                  Entropy (8bit):5.027445846313988E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:LsulcFw:LsFe
                                                                                  MD5:DABF4D78F2B21B53CECDC14F3C77C8EE
                                                                                  SHA1:F4355A8C8EF592AF61961B4C3D17B77489E68D60
                                                                                  SHA-256:6D47C242C3DC503F7B112DD0F1F8427D7EB486B503BB9DE652F57D01F25F10CD
                                                                                  SHA-512:BF50D2A3FB6E5B1C36354437AA8A52FC76E20196E6FF2397760AA626974A658FD4AB9D1B683BDC88A5DBB1570A7D5973ABA72AB19EB04B60AC54F8642AD50C80
                                                                                  Malicious:false
                                                                                  Preview:......................................... 2../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.01057775872642915
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsFl:/F
                                                                                  MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                  SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                  SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                  SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                  Malicious:false
                                                                                  Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):270336
                                                                                  Entropy (8bit):0.0012471779557650352
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                  MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                  SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                  SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                  SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.011852361981932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsHlDll:/H
                                                                                  MD5:0962291D6D367570BEE5454721C17E11
                                                                                  SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                  SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                  SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.012340643231932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsGl3ll:/y
                                                                                  MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                  SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                  SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                  SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):262512
                                                                                  Entropy (8bit):9.448177365217996E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:LsNltall:Ls34
                                                                                  MD5:A59EA83D920E7FF19A2D0EAA826FB2E5
                                                                                  SHA1:EB14CF33BD3383571CB6FC81A1EFB171540968D8
                                                                                  SHA-256:002C6FE298BB7D4744DD0F2FFA79167BCCEDCC31B96309A443A5828D68FE4E4B
                                                                                  SHA-512:97ABCF8D5BF3BBE7194D19D2CB62EC35D6AAE7CC97DC7F555AB171D650182FA6731449E9D264DCD36ACE722FF120E6186E98621DADDCE8D079344ECC27304AC7
                                                                                  Malicious:false
                                                                                  Preview:........................................8..1../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):270336
                                                                                  Entropy (8bit):0.0012471779557650352
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                  MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                  SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                  SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                  SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):432
                                                                                  Entropy (8bit):5.277380403848679
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:P5pMM+vYfYebvqBQFUt825pZ/+25hMV5JfYebvqBvJ:BAYfYebvZg8A9cJfYebvk
                                                                                  MD5:8FBBA36EA9CCFB151C5A8CC3FC976540
                                                                                  SHA1:7546E0202DECB502C36BC2150E5E153142EFD509
                                                                                  SHA-256:C72D69A3B900ADFD3205E3BE969F34C1A3374AB87C73AE0E54254A86D210A2EC
                                                                                  SHA-512:E2E77B08835CDE17A0A27F22873A26365412CC65A7500E274015EC02A440F9FE7BDA77AF9026FFEB2823074E7449E2207CCEBC24A62BC5D6E42D4ADC2060B808
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.734 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/01-16:45:56.734 1ffc Recovering log #3.2024/09/01-16:45:56.737 1ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):432
                                                                                  Entropy (8bit):5.277380403848679
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:P5pMM+vYfYebvqBQFUt825pZ/+25hMV5JfYebvqBvJ:BAYfYebvZg8A9cJfYebvk
                                                                                  MD5:8FBBA36EA9CCFB151C5A8CC3FC976540
                                                                                  SHA1:7546E0202DECB502C36BC2150E5E153142EFD509
                                                                                  SHA-256:C72D69A3B900ADFD3205E3BE969F34C1A3374AB87C73AE0E54254A86D210A2EC
                                                                                  SHA-512:E2E77B08835CDE17A0A27F22873A26365412CC65A7500E274015EC02A440F9FE7BDA77AF9026FFEB2823074E7449E2207CCEBC24A62BC5D6E42D4ADC2060B808
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.734 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/01-16:45:56.734 1ffc Recovering log #3.2024/09/01-16:45:56.737 1ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\106cb76d-bbbf-4d8a-b52f-5da3db8ba6ab.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):40
                                                                                  Entropy (8bit):4.1275671571169275
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                  MD5:20D4B8FA017A12A108C87F540836E250
                                                                                  SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                  SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                  SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                  Malicious:false
                                                                                  Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6d66d017-3a4a-4216-8fdd-93f6e2b90f1d.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):111
                                                                                  Entropy (8bit):4.718418993774295
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                  MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                  SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                  SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                  SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):193
                                                                                  Entropy (8bit):4.864047146590611
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                  MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                  SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                  SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                  SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF2d0f2.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):193
                                                                                  Entropy (8bit):4.864047146590611
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                  MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                  SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                  SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                  SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3bce8.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):193
                                                                                  Entropy (8bit):4.864047146590611
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                  MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                  SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                  SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                  SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                  Category:dropped
                                                                                  Size (bytes):36864
                                                                                  Entropy (8bit):0.555790634850688
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                  MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                  SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                  SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                  SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2b9ef.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):40
                                                                                  Entropy (8bit):4.1275671571169275
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                  MD5:20D4B8FA017A12A108C87F540836E250
                                                                                  SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                  SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                  SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                  Malicious:false
                                                                                  Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                  Category:dropped
                                                                                  Size (bytes):36864
                                                                                  Entropy (8bit):0.36515621748816035
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                  MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                  SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                  SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                  SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d032ef3c-af31-4039-91e2-7c6fbaf13f3f.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):193
                                                                                  Entropy (8bit):4.864047146590611
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                  MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                  SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                  SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                  SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                  Malicious:false
                                                                                  Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d3d6d8dc-e604-4e23-b773-889e8baee8ec.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\de9ea058-5c46-4e17-a657-6e9d1112b143.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2
                                                                                  Entropy (8bit):1.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:H:H
                                                                                  MD5:D751713988987E9331980363E24189CE
                                                                                  SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                  SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                  SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                  Malicious:false
                                                                                  Preview:[]

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):80
                                                                                  Entropy (8bit):3.4921535629071894
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                  MD5:69449520FD9C139C534E2970342C6BD8
                                                                                  SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                  SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                  SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                  Malicious:false
                                                                                  Preview:*...#................version.1..namespace-..&f.................&f...............

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):420
                                                                                  Entropy (8bit):5.215056279640781
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:P5NzWM+vYfYebvqBZFUt825NzzZ/+25NzZMV5JfYebvqBaJ:BKYfYebvyg8AZmJfYebvL
                                                                                  MD5:6B9721289F5B0C82B606230CB7037705
                                                                                  SHA1:DF3DE60F2E79E7FCAD841AD096A5DDC0F2120E85
                                                                                  SHA-256:4F480518B9E5F8CD55BB2F2E6B34BB884678782D14F82B9021141B070BD19080
                                                                                  SHA-512:3AFE8055363CC5EA66DAB3BD5F7CFF64CD700918D4D4AD71EF1608F9BB1A7C7C2058C938C772E38ABF303283345A1492544C8673566C396B34A2D24AB4C8A0EB
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:46:13.202 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/01-16:46:13.204 1ffc Recovering log #3.2024/09/01-16:46:13.212 1ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):420
                                                                                  Entropy (8bit):5.215056279640781
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:P5NzWM+vYfYebvqBZFUt825NzzZ/+25NzZMV5JfYebvqBaJ:BKYfYebvyg8AZmJfYebvL
                                                                                  MD5:6B9721289F5B0C82B606230CB7037705
                                                                                  SHA1:DF3DE60F2E79E7FCAD841AD096A5DDC0F2120E85
                                                                                  SHA-256:4F480518B9E5F8CD55BB2F2E6B34BB884678782D14F82B9021141B070BD19080
                                                                                  SHA-512:3AFE8055363CC5EA66DAB3BD5F7CFF64CD700918D4D4AD71EF1608F9BB1A7C7C2058C938C772E38ABF303283345A1492544C8673566C396B34A2D24AB4C8A0EB
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:46:13.202 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/01-16:46:13.204 1ffc Recovering log #3.2024/09/01-16:46:13.212 1ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):326
                                                                                  Entropy (8bit):5.2747688457084125
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTQF8q2Pwkn23oH+TcwtpIFUt82VTQiTZZmw+2VTQkukwOwkn23oH+Tcwta/WLJ:P5BvYfYebmFUt825zTZ/+2565JfYebaQ
                                                                                  MD5:04D9D35738C7ED31E2177FD6A2017ECD
                                                                                  SHA1:0184D4D89F7A900FFED1EFD26018A5B05BDF7BEF
                                                                                  SHA-256:57C58E7BB121BC755DF4558AF191EBC560024676F922740748EA7C18EC844432
                                                                                  SHA-512:DC2A6D709D275C233271D6FF62DEDEDB187BF8CDF6FDCC9672EF5821434CF82209FC0966AACC6216B069E662E486CAFEFA88673EF4719D5369D191D02A2BECB7
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:55.867 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/01-16:45:55.868 1e74 Recovering log #3.2024/09/01-16:45:55.869 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):326
                                                                                  Entropy (8bit):5.2747688457084125
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTQF8q2Pwkn23oH+TcwtpIFUt82VTQiTZZmw+2VTQkukwOwkn23oH+Tcwta/WLJ:P5BvYfYebmFUt825zTZ/+2565JfYebaQ
                                                                                  MD5:04D9D35738C7ED31E2177FD6A2017ECD
                                                                                  SHA1:0184D4D89F7A900FFED1EFD26018A5B05BDF7BEF
                                                                                  SHA-256:57C58E7BB121BC755DF4558AF191EBC560024676F922740748EA7C18EC844432
                                                                                  SHA-512:DC2A6D709D275C233271D6FF62DEDEDB187BF8CDF6FDCC9672EF5821434CF82209FC0966AACC6216B069E662E486CAFEFA88673EF4719D5369D191D02A2BECB7
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:55.867 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/01-16:45:55.868 1e74 Recovering log #3.2024/09/01-16:45:55.869 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                                                                                  Category:dropped
                                                                                  Size (bytes):28672
                                                                                  Entropy (8bit):0.26707851465859517
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
                                                                                  MD5:04F8B790DF73BD7CD01238F4681C3F44
                                                                                  SHA1:DF12D0A21935FC01B36A24BF72AB9640FEBB2077
                                                                                  SHA-256:96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
                                                                                  SHA-512:0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):131072
                                                                                  Entropy (8bit):0.005567161523650777
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:ImtVx//l/3eQV/yE/logt:IiVt/teQ4Eto
                                                                                  MD5:1910530341B647392436E1149E666FC3
                                                                                  SHA1:45926930D27BF7748C9B1720031096C99542A1C4
                                                                                  SHA-256:01B9B149F4BEABC4819EF73642F97622DC1F854A308017847110232004B0AC87
                                                                                  SHA-512:F33CE1B8A05F6A95E5F561FF53B76488BBB96990F6FC574CC8F28C14C285FD42AE9C7175CC920D24E9252DC689D02F97816F6CD6C24B88B82F3F960172ADF804
                                                                                  Malicious:false
                                                                                  Preview:VLnk.....?.........u.6Q.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
                                                                                  Category:dropped
                                                                                  Size (bytes):184320
                                                                                  Entropy (8bit):1.0668778620037704
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:QSqzWMMUfTlnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYt7n6:QrzWMff5nzkkqtXnTK+hNH+5EVumO
                                                                                  MD5:F53468979E62DCC661A3B3E7505B2B26
                                                                                  SHA1:31A17D5DB760CD7563B60A4FA11FE740534E0D5A
                                                                                  SHA-256:D90116EC91F38BEF6F7A6EB525FD575E6211F3F1605607E6D9B5DDF6067DB123
                                                                                  SHA-512:2D175E9EE4A572FA4553220DE001EF8647B0E68E137ABF6244DA5549123902BA5902236730CB6BA511FB2F7D63EAB4F2A8775826D51D65198F3CCA85844B5C0C
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
                                                                                  Category:dropped
                                                                                  Size (bytes):14336
                                                                                  Entropy (8bit):1.4169280909643869
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:uOK3tjkSdj5IUltGhp22iSBgj2RyOXwkWGmL2RyOXwkWcj/:PtSjGhp22iS3TLWGmCTLWm
                                                                                  MD5:AFF6F14A01408ECC1C1616DB94134067
                                                                                  SHA1:AC3757F91A762E3BDF9C2A74588494473E80EF4E
                                                                                  SHA-256:EFE12B2927C6DEA01817957B144224093F9EF0793C39D31E5580EA89CB51D6DD
                                                                                  SHA-512:FC18C9FC8D14ACDCB8DC29CB9D092CEB8FD86D69E03BA661FBB6A619709EBFDEA95C5B82635F6DE12C863769A883B4F91FACCE79819390C32D94685F96275E80
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                  Category:dropped
                                                                                  Size (bytes):40960
                                                                                  Entropy (8bit):0.41235120905181716
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
                                                                                  MD5:981F351994975A68A0DD3ECE5E889FD0
                                                                                  SHA1:080D3386290A14A68FCE07709A572AF98097C52D
                                                                                  SHA-256:3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
                                                                                  SHA-512:C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a7064f56-8c2a-4277-9156-313fe577b1c4.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):28367
                                                                                  Entropy (8bit):5.558237999768803
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:Z5Cnnd7pLGLvP+WPrvfSM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPyntrrwzJp+tue:Z5CnnLcvP+WPrvfSMu1jaeKtgz+tR
                                                                                  MD5:A46BB1CE9A4C9F9ED6FB4C93F24CD39A
                                                                                  SHA1:FBF375FC9870D02829CB601058EDA7F83C3779F3
                                                                                  SHA-256:BF22689DD8C199FA2A66C686008A15305ED323E53CF7B354C54AE7FF3C95AD2D
                                                                                  SHA-512:BD3C5C2C7C37EEC98AD4F188E02CDAFEE1566882682484F7D3BD2A05962FFC732355C1A0D0295D107BF3B05407D78B357B09155238A3C6F95A3C5C4A27C72F34
                                                                                  Malicious:false
                                                                                  Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369697155130540","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369697155130540","location":5,"ma

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\acc5418e-555c-4086-9eec-c5670fde4d0b.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:very short file (no magic)
                                                                                  Category:dropped
                                                                                  Size (bytes):1
                                                                                  Entropy (8bit):0.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:L:L
                                                                                  MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                  SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                  SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                  SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                  Malicious:false
                                                                                  Preview:.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):11755
                                                                                  Entropy (8bit):5.190465908239046
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                  MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                  SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                  SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                  SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                  Malicious:false
                                                                                  Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ca24d56b-2202-4ad6-b9f3-b040d9a6d7e1.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):10989
                                                                                  Entropy (8bit):5.1712534898339415
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1CjAWC/VYm3j8clpj+FR0QAAu9+n1f:sVmFJF1uAWCvlpUeQhu9+
                                                                                  MD5:9CA0ABAC43F8499177481E8725677F40
                                                                                  SHA1:FD9ACA61049251DF35C28D2648E5EF48A9341655
                                                                                  SHA-256:D2D08E32F5FC16E9EFB6484C7BB26BE0F3E6C9B7EB4E7EBF046728D611FE6CE0
                                                                                  SHA-512:5A5713F9F00553CCE407CB2F90BA96366354FA3F1A46334402D5B4AD165771E63A14E56E9175E87F3B813CCFEA65D9D9005D29BC7535D5D29989A7B356C5C1FA
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d65202c7-e5c6-4c25-9b9b-e173dbc36ec5.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):11099
                                                                                  Entropy (8bit):5.169908845688499
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:sVmkdGJrB1CjAWC/VYm3j8clpj+FR0QA0i9+n1f:sVmFJF1uAWCvlpUeQNi9+
                                                                                  MD5:44F79B52E31BD5099153942FCDB03CBF
                                                                                  SHA1:8436F6509C5E99B51B248A5D9E1994568D07068F
                                                                                  SHA-256:7553CB74BAB24B6F3A24CA2620AB03C0E794CFB7E3A51AC1A9D1DBB0C1FAB81E
                                                                                  SHA-512:A71C8DDE9AFF9C27598623E58EFD0989CE6F1A531FF6F1EBEE8A73125B350584B530177E855FF4B0E869C249F08C68469DE6B7C28944F4C9050631F2333602AE
                                                                                  Malicious:false
                                                                                  Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369697156425667","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d9486291-1149-49da-96e7-9a920828a8a1.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):25012
                                                                                  Entropy (8bit):5.5677754919671125
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:Z5CnE+WPrvf1M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPyntrrwwp+tuK:Z5CnE+WPrvf1Mu1jaeKtgpt9
                                                                                  MD5:C8D0241611959794CB53562D8D69F3AF
                                                                                  SHA1:216A3DFE7C0FFA96D2AE0C3D6B08E5F83E56D721
                                                                                  SHA-256:9B19FF3882E2B9FB474EC3B22DDEB083C7618583990C1A409D97D69F3C983A7D
                                                                                  SHA-512:AA47B88C2AA6EC28164E7177AAB6E165E99B485E88DCF5E26ACEF3769403CD37F87AF7F1D136D2A9CDA5C6C901F934984706C0119AD5B9E3DED08C012354CC9B
                                                                                  Malicious:false
                                                                                  Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369697155130540","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369697155130540","location":5,"ma

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                  Category:dropped
                                                                                  Size (bytes):28672
                                                                                  Entropy (8bit):0.3410017321959524
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
                                                                                  MD5:98643AF1CA5C0FE03CE8C687189CE56B
                                                                                  SHA1:ECADBA79A364D72354C658FD6EA3D5CF938F686B
                                                                                  SHA-256:4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
                                                                                  SHA-512:68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                  Category:dropped
                                                                                  Size (bytes):16384
                                                                                  Entropy (8bit):0.35226517389931394
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
                                                                                  MD5:D2CCDC36225684AAE8FA563AFEDB14E7
                                                                                  SHA1:3759649035F23004A4C30A14C5F0B54191BEBF80
                                                                                  SHA-256:080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
                                                                                  SHA-512:1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):32768
                                                                                  Entropy (8bit):0.09717136775698257
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:G9l/227Y9l/22hX9XHl/Vl/Unkl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/VlG:Ct22E9t22hdFnnnnnnnnnnnnnnpEo
                                                                                  MD5:9733F0271762F6D8C1582B6AD3982A8A
                                                                                  SHA1:68B2DDC5E654FBE151F0A50C85FB51DE7B765B22
                                                                                  SHA-256:830E55AACFE12347C2C62BCD2E65A0ED6B6E0FB8F26D5B4004864F8C2F04BA11
                                                                                  SHA-512:ECDCF41FB1C96ED69EC08CC4F896D0C9F11DBCCEBD54350999D805B3BF31485535AE2E41C8D8FF466A3696BBD43A1106C33E4F237D02860557BBFD9BD9B04C30
                                                                                  Malicious:false
                                                                                  Preview:..-.............H.........Z....r.d"..%..0W...l....-.............H.........Z....r.d"..%..0W...l..........D...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite Write-Ahead Log, version 3007000
                                                                                  Category:dropped
                                                                                  Size (bytes):296672
                                                                                  Entropy (8bit):1.0195447821966361
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:5o+EB9nAeBYPC14fIdYH71WHoLOHci8NeGieIh:4
                                                                                  MD5:41973763570E4A48D88ABDE4A91C00F0
                                                                                  SHA1:6BEAA8A2E4EDD91C605DB6461011E44394C09B0A
                                                                                  SHA-256:744CB79B951C919BEA61AA0EAE14A8D98470EBEB869C6595318535C6794D330E
                                                                                  SHA-512:942F75243B33C6B0311FB345A469F953DD378B7FC4E66A015FBCD10F5444C597B51066C1A1041883D635D520E2FFFDC4E93BD2058F6E0B2E9059C8781BC5AA47
                                                                                  Malicious:false
                                                                                  Preview:7....-...........d"..%....g.l.dH.........d"..%.....u....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:modified
                                                                                  Size (bytes):250
                                                                                  Entropy (8bit):3.6968918782369986
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:VVXntjQPEnjQMFkmtl3seGKT9rcQ6x/wXQNEOtlTxotlTxotlTxotlTxotlTxotg:/XntM+tl3sedhO4XdOuuuuuu
                                                                                  MD5:331C300480A93BBFFD675A39AFBAB3FC
                                                                                  SHA1:9A248EF0FF3B4B5A21E47E00FCADD1799FF3298C
                                                                                  SHA-256:87F7E05599258D1C76BFDD3CBC898C5CF4D0EB2AEE83152825E30221DA1C6696
                                                                                  SHA-512:EBD2040286F94C28325ACDC98D8C237DA9BC0152159BC9F5AE31BFD74BA68223823B11DDEBA7E650710A9214B4B923B835D53CEF901B4B1EDFF312E42F9CCBA0
                                                                                  Malicious:false
                                                                                  Preview:A..r.................20_1_1...1.,U.................20_1_1...1.O.(0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):281
                                                                                  Entropy (8bit):5.205530341354086
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVTGv81wkn23oH+Tcwtfrl2KLllVTIWIq2Pwkn23oH+TcwtfrK+IFUv:P56bfYeb1Ln5IWIvYfYeb23FUv
                                                                                  MD5:BCA8D4E2918CE48ADFECD4238D5EBD9A
                                                                                  SHA1:0E036168DD3FADAE8CA4F616607E3F969E9C610F
                                                                                  SHA-256:8EF2DBDB5683DC5553FED1DC6BA30CAFE8B2C98D1D0E873CD8B045CBFB4C9D9D
                                                                                  SHA-512:3EECBEF388F0C579E4BF5604F72927C9B757B389DFB837D5B0A8CC982F0903EBB175E1E5932CCC889FC28C52C044297AC753634EC79BDE13266E36C9C5092E8A
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.476 1ee0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/09/01-16:45:56.490 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:OpenPGP Secret Key
                                                                                  Category:dropped
                                                                                  Size (bytes):41
                                                                                  Entropy (8bit):4.704993772857998
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                  MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                  SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                  SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                  SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                  Malicious:false
                                                                                  Preview:.|.."....leveldb.BytewiseComparator......

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):617
                                                                                  Entropy (8bit):3.9325179151892424
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:G0nYUteza//z3p/Uz0RuWlJhC+lvBavRtin01zv0:G0nYUtezaD3RUovhC+lvBOL0
                                                                                  MD5:AD15D72AA4792C14DDD002CED70E8245
                                                                                  SHA1:30D0E75166FDA7126A73480EE3222C193231B579
                                                                                  SHA-256:17A781FB31D3176491D9B277ADEEE5521972C68956A2271637BBCBFEB27D6A7D
                                                                                  SHA-512:20B8D19B529A392FE0CBB44844926210D98C477498377B8370AA3A3A763C047EF96BE341686406522868EF848C83EF5EF4792B17CDD0462D4680EDA542C8A54F
                                                                                  Malicious:false
                                                                                  Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.|.................9_.....'\c..................9_.....

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):16
                                                                                  Entropy (8bit):3.2743974703476995
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                  MD5:46295CAC801E5D4857D09837238A6394
                                                                                  SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                  SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                  SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                  Malicious:false
                                                                                  Preview:MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):299
                                                                                  Entropy (8bit):5.164473687321737
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:PVT8UE81wkn23oH+Tcwtfrzs52KLllVTGCAq2Pwkn23oH+TcwtfrzAdIFUv:P58UEbfYebs9Ln5lAvYfYeb9FUv
                                                                                  MD5:2D82308D6F6BD93D23B4A70CDD620478
                                                                                  SHA1:F881E00C5DE43025A59A4A2E6E8573F47AABDA39
                                                                                  SHA-256:EA75324E682C15D612EDDF9B4F324F0760B0EA80A7B29566A2DC447B9C1FB4B1
                                                                                  SHA-512:1A297B9B15DEB0083923CE9FA235FD7E1487FDF466A57B058232A050C16C7B023EB06037923FD8018677E05BED0FF9497F7417890441DD6D2AA856DF80FF5D12
                                                                                  Malicious:false
                                                                                  Preview:2024/09/01-16:45:56.461 1ee0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/09/01-16:45:56.474 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:OpenPGP Secret Key
                                                                                  Category:dropped
                                                                                  Size (bytes):41
                                                                                  Entropy (8bit):4.704993772857998
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                  MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                  SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                  SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                  SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                  Malicious:false
                                                                                  Preview:.|.."....leveldb.BytewiseComparator......

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.01057775872642915
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsFl:/F
                                                                                  MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                  SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                  SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                  SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                  Malicious:false
                                                                                  Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):270336
                                                                                  Entropy (8bit):8.280239615765425E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                  MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                  SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                  SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                  SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.011852361981932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsHlDll:/H
                                                                                  MD5:0962291D6D367570BEE5454721C17E11
                                                                                  SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                  SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                  SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.012340643231932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsGl3ll:/y
                                                                                  MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                  SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                  SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                  SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):262512
                                                                                  Entropy (8bit):9.553120663130604E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:LsNlbB/ll:Ls3bR
                                                                                  MD5:E2923BEFDA7E8E57AA846D7C76A99C66
                                                                                  SHA1:0BCF2F570506324D904CDA7955F34A3E386FAA61
                                                                                  SHA-256:5CF34F493644279695DB61A1519930DFC2FFBC87F457E228755369A99F03DF8D
                                                                                  SHA-512:AD4D2566E98C86F524993B36702BEB609C1E465F00D7CD511E49EF9FCA8635D3B071D23A0B5FCB38ACBEC60D53977C2B688368F5DA09E20E8A49AE5617972024
                                                                                  Malicious:false
                                                                                  Preview:........................................R5.1../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.01057775872642915
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsFl:/F
                                                                                  MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                  SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                  SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                  SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                  Malicious:false
                                                                                  Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):270336
                                                                                  Entropy (8bit):8.280239615765425E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                  MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                  SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                  SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                  SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.011852361981932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsHlDll:/H
                                                                                  MD5:0962291D6D367570BEE5454721C17E11
                                                                                  SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                  SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                  SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.012340643231932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsGl3ll:/y
                                                                                  MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                  SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                  SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                  SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):262512
                                                                                  Entropy (8bit):9.553120663130604E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:LsNlHWaul:Ls32R
                                                                                  MD5:CA07D5B89B7804D5D86DF52161CD7D5E
                                                                                  SHA1:193EFD486EE8F9879018FF4ABA55DCA4742D952E
                                                                                  SHA-256:99E04A96122954B2064C1A6C58651FD66E73D0D898BF23F896F839034965D335
                                                                                  SHA-512:63AAED66E2F0E7F8008B324806B221142F9382AAFC8E542A48D10DB0BEC1D5B4E68706C6CDBBC9BD9C371027DE409E3BFBDF385E3D06A56D40EC9948D05A2750
                                                                                  Malicious:false
                                                                                  Preview:..........................................1../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):120
                                                                                  Entropy (8bit):3.32524464792714
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                  MD5:A397E5983D4A1619E36143B4D804B870
                                                                                  SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                  SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                  SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                  Malicious:false
                                                                                  Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):13
                                                                                  Entropy (8bit):2.7192945256669794
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:NYLFRQI:ap2I
                                                                                  MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                  SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                  SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                  SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                  Malicious:false
                                                                                  Preview:117.0.2045.47

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28870.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2888f.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28e4c.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28ef7.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b368.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2cfaa.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d008.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d037.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d056.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2efd4.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39b47.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c267.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3fba7.TMP (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):6820
                                                                                  Entropy (8bit):5.79523638964411
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:akBYj9teiRUkhd6qRAq1k8SPxVLZ7VTiq:akazPd6q3QxVNZTiq
                                                                                  MD5:75FEA1060523243D1DF7FCED534C9AC3
                                                                                  SHA1:E34F7CA9519DD6D8D996231B6FD7E238263C79F0
                                                                                  SHA-256:1DC7305884DF27B8DEE5F0156AD21DB760EB9248779C7969593A40679181E19D
                                                                                  SHA-512:393DA35E10642CEE5EEF4CEC4F1A98FDBD3247316FFA26AA87B6B14A028190534DF7F134D3AF7F20024F8606D998C754CFABAE8D1AE2F120FA0C7F58A5A80869
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAB0GETeMZVfRINsWThxEzQ4EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADKfTP/goW9QRR6GlRakFosd8VS7P9gXVNgMsUIjPhxuwAAAAA

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
                                                                                  Category:dropped
                                                                                  Size (bytes):20480
                                                                                  Entropy (8bit):0.5963118027796015
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isTydBVzQd9U9ez/qS9i:TLyXOUOq0afDdWec9sJz+Z7J5fc
                                                                                  MD5:48A6A0713B06707BC2FE9A0F381748D3
                                                                                  SHA1:043A614CFEF749A49837F19F627B9D6B73F15039
                                                                                  SHA-256:2F2006ADEA26E5FF95198883A080C9881D774154D073051FC69053AF912B037B
                                                                                  SHA-512:4C04FFAE2B558EB4C05AD9DCA094700D927AFAD1E561D6358F1A77CB09FC481A6424237DFF6AB37D147E029E19D565E876CD85A2E9C0EC1B068002AA13A16DBA
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.01057775872642915
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsFl:/F
                                                                                  MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                  SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                  SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                  SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                  Malicious:false
                                                                                  Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):270336
                                                                                  Entropy (8bit):8.280239615765425E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                  MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                  SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                  SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                  SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.011852361981932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsHlDll:/H
                                                                                  MD5:0962291D6D367570BEE5454721C17E11
                                                                                  SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                  SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                  SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):8192
                                                                                  Entropy (8bit):0.012340643231932763
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:MsGl3ll:/y
                                                                                  MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                  SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                  SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                  SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                  Category:dropped
                                                                                  Size (bytes):262512
                                                                                  Entropy (8bit):9.553120663130604E-4
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:LsNlcaKl/l:Ls3rKlt
                                                                                  MD5:E6C4E991B3EAC88F9D1E6D6AFA2E442A
                                                                                  SHA1:DAF8873767D232D3728BFD271979CE3BF99D747B
                                                                                  SHA-256:2EEC80ACCA4F82089041D07FA47DE5E874D85C5C3BED6C1CA5BFCA41BCD1C66A
                                                                                  SHA-512:41E843D62BD093BB2BDF757199176F067479B2046F2E3EDD8A24698F42C7E8C8FADC580F65173A5A71C240EF2DDE6FB9D4C54DA79A80D20C7379631D0D7087FF
                                                                                  Malicious:false
                                                                                  Preview:.........................................r.1../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):47
                                                                                  Entropy (8bit):4.3818353308528755
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                                                  MD5:48324111147DECC23AC222A361873FC5
                                                                                  SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                                                  SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                                                  SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                                                  Malicious:false
                                                                                  Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):35
                                                                                  Entropy (8bit):4.014438730983427
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                                                  MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                                                  SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                                                  SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                                                  SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                                                  Malicious:false
                                                                                  Preview:{"forceServiceDetermination":false}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):29
                                                                                  Entropy (8bit):3.922828737239167
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:2NGw+K+:fwZ+
                                                                                  MD5:7BAAFE811F480ACFCCCEE0D744355C79
                                                                                  SHA1:24B89AE82313084BB8BBEB9AD98A550F41DF7B27
                                                                                  SHA-256:D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
                                                                                  SHA-512:70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
                                                                                  Malicious:false
                                                                                  Preview:customSynchronousLookupUris_0

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):35302
                                                                                  Entropy (8bit):7.99333285466604
                                                                                  Encrypted:true
                                                                                  SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                  MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                  SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                  SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                  SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                  Malicious:false
                                                                                  Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):18
                                                                                  Entropy (8bit):3.5724312513221195
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:kDnaV6bVon:kDYa2
                                                                                  MD5:5692162977B015E31D5F35F50EFAB9CF
                                                                                  SHA1:705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
                                                                                  SHA-256:42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
                                                                                  SHA-512:32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
                                                                                  Malicious:false
                                                                                  Preview:edgeSettings_2.0-0

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):3581
                                                                                  Entropy (8bit):4.459693941095613
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
                                                                                  MD5:BDE38FAE28EC415384B8CFE052306D6C
                                                                                  SHA1:3019740AF622B58D573C00BF5C98DD77F3FBB5CD
                                                                                  SHA-256:1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
                                                                                  SHA-512:9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
                                                                                  Malicious:false
                                                                                  Preview:{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):47
                                                                                  Entropy (8bit):4.493433469104717
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:kfKbQSQSuLA5:kyUc5
                                                                                  MD5:3F90757B200B52DCF5FDAC696EFD3D60
                                                                                  SHA1:569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
                                                                                  SHA-256:1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
                                                                                  SHA-512:39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
                                                                                  Malicious:false
                                                                                  Preview:synchronousLookupUris_636976985063396749.rel.v2

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):35302
                                                                                  Entropy (8bit):7.99333285466604
                                                                                  Encrypted:true
                                                                                  SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                  MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                  SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                  SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                  SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                  Malicious:false
                                                                                  Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):50
                                                                                  Entropy (8bit):3.9904355005135823
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:0xXF/XctY5GUf+:0RFeUf+
                                                                                  MD5:E144AFBFB9EE10479AE2A9437D3FC9CA
                                                                                  SHA1:5AAAC173107C688C06944D746394C21535B0514B
                                                                                  SHA-256:EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
                                                                                  SHA-512:837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
                                                                                  Malicious:false
                                                                                  Preview:topTraffic_170540185939602997400506234197983529371

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):575056
                                                                                  Entropy (8bit):7.999649474060713
                                                                                  Encrypted:true
                                                                                  SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                                                  MD5:BE5D1A12C1644421F877787F8E76642D
                                                                                  SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                                                  SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                                                  SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                                                  Malicious:false
                                                                                  Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):86
                                                                                  Entropy (8bit):4.389669793590032
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
                                                                                  MD5:03B6D5E81A4DC4D4E6C27BE1E932B9D9
                                                                                  SHA1:3C5EF0615314BDB136AB57C90359F1839BDD5C93
                                                                                  SHA-256:73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
                                                                                  SHA-512:0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
                                                                                  Malicious:false
                                                                                  Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c2d41820-6f3b-4ef9-80da-19ef5d8fd503.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):8239
                                                                                  Entropy (8bit):5.797325941893942
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:fsNABYj9LeiRUGAjwkye6qRAq1k8SPxVLZ7VTiQ:fsNAaBFWbye6q3QxVNZTiQ
                                                                                  MD5:DDC090129DC4A87E2FAC7FA2DED2C068
                                                                                  SHA1:BDF15EE1B9AE8400CEB28CD11228F1196B361A77
                                                                                  SHA-256:F26FD51883C71D7490C0D514E356B46920AACDBCB0E62CC2A21A3AC049A1C50B
                                                                                  SHA-512:5BC9B6FEAC7865A7020E7EC8EA9DE4B2B139700B27BB1501146AEB1347DCC8F08356EEB02A611604B16730D56089662462F0DD83C6522896E074B5B92074152D
                                                                                  Malicious:false
                                                                                  Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d0e2a2fc-ea67-4097-afdc-a8347384b619.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):23967
                                                                                  Entropy (8bit):6.049802068485145
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:btMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwheP28JGblkyR0+Mh0lkdHd5q2:RMGQ7FCYXGIgtDAWtJ4n14PxGBkyRUhf
                                                                                  MD5:813193BEB2740078A58FBE7CA145E821
                                                                                  SHA1:2DE4F935F66CDB42AB3236AF4E82B52C3371085D
                                                                                  SHA-256:1477BFD0E602C7B8D545E024A408719CEE0726997ACA6D58FCF8618DB249FB78
                                                                                  SHA-512:A15E58B4E1B052A9C4A019C709902E1E56496A82AE0F5B5D26452D8773A923B3F59B129F2A340BCCC8A449913E1D8453235C01137C0600999EEE4CB0F6CDEF94
                                                                                  Malicious:false
                                                                                  Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369697156540697","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                  C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):2278
                                                                                  Entropy (8bit):3.8515447917710257
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:uiTrlKxrgxKxl9Il8uXnF3DIcehyY1QbAI5aD76d1rc:mjYhFmyQoaR
                                                                                  MD5:BC1F0DE193C8986B0A5760A1AB7DD4BF
                                                                                  SHA1:3C67DFBB7B10208C27A13CB30915E261552080B1
                                                                                  SHA-256:2561A08888C259EE8044283BE3FB280B2D9993D1D748D49DFCEB45639E11906B
                                                                                  SHA-512:616FEECC0EDDDAEE8056B18D91B971CBF6F17AF767CE15297A2A7A2B4B14D9F039501F3EE09A298AC38AB1B7F90034B452ABA396AA243D9FDEEF1AB0C540D538
                                                                                  Malicious:false
                                                                                  Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.y.H.V.b.j.8.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.B.h.E.3.j.

                                                                                  C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):4622
                                                                                  Entropy (8bit):3.995461342900727
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:cYhGJKN5CuR6/ACyWGC3s1wRe5wVFXh4x+zp+UOe:ccGkhUACyvC8e+wHw+zp+U5
                                                                                  MD5:4E39581429DF206969A2B90A55F6F5C7
                                                                                  SHA1:B8D22C542EBBF6F2DD528E20DF5F4F3DAC204B55
                                                                                  SHA-256:261042354EF1DB523871019C6E317C9C463036ED6E971472165E4C5BB1CFE228
                                                                                  SHA-512:9D19787268CEAA63CE50A975F07AB3FA8E4DB8BB6DC065F02E10C7BE42F208C3D85D0CA8C5138D2B432102B0E0C720ACC694FD6A239BEC53267E21B718A3F25B
                                                                                  Malicious:false
                                                                                  Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".X.O.g.0.O.7.D.8.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.B.h.E.3.j.

                                                                                  C:\Users\user\AppData\Local\Temp\8786ffc6-0dde-477f-9d1e-43d48e9e474e.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:very short file (no magic)
                                                                                  Category:dropped
                                                                                  Size (bytes):1
                                                                                  Entropy (8bit):0.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:L:L
                                                                                  MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                  SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                  SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                  SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                  Malicious:false
                                                                                  Preview:.

                                                                                  C:\Users\user\AppData\Local\Temp\9d0bfe10-b2dc-4894-87c3-b96e2de5fb30.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:Google Chrome extension, version 3
                                                                                  Category:dropped
                                                                                  Size (bytes):135751
                                                                                  Entropy (8bit):7.804610863392373
                                                                                  Encrypted:false
                                                                                  SSDEEP:1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
                                                                                  MD5:83EF25FBEE6866A64F09323BFE1536E0
                                                                                  SHA1:24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
                                                                                  SHA-256:F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
                                                                                  SHA-512:C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
                                                                                  Malicious:false
                                                                                  Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7..*.Kk?....]<.S(.....9}........$..6...:...9..b|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]..*..-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

                                                                                  C:\Users\user\AppData\Local\Temp\9f551a28-4aa3-4e52-b93b-f4f8affc879f.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:Google Chrome extension, version 3
                                                                                  Category:dropped
                                                                                  Size (bytes):11185
                                                                                  Entropy (8bit):7.951995436832936
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                  MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                  SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                  SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                  SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                  Malicious:false
                                                                                  Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                  C:\Users\user\AppData\Local\Temp\b2dd3d58-d92a-4b8a-a1d0-9b7a53b223d6.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:very short file (no magic)
                                                                                  Category:dropped
                                                                                  Size (bytes):1
                                                                                  Entropy (8bit):0.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:L:L
                                                                                  MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                  SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                  SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                  SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                  Malicious:false
                                                                                  Preview:.

                                                                                  C:\Users\user\AppData\Local\Temp\c3de4532-f7f0-433d-967c-c41610cf0a86.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 695787
                                                                                  Category:dropped
                                                                                  Size (bytes):555971
                                                                                  Entropy (8bit):7.997779343928087
                                                                                  Encrypted:true
                                                                                  SSDEEP:12288:UfdQMCC4a1gBJ+gyX/uUVMf+xVmY6R9gAmcbW6TLL:UOMzuTG2+xVmYQkov/
                                                                                  MD5:CBF70412B7A8B936E5F23E20AAD6C820
                                                                                  SHA1:9138E228B1F78562D8159924BED9E6543A1F4FFC
                                                                                  SHA-256:5420E9163BACA0E73E9B861AF48D14017E43D76FE5AE426B8BB76E8B5811148B
                                                                                  SHA-512:5628D3FB67B27B42626EC430E01308AD2EAD6369AB080A852A6E1D41A821032BD6377094443F01266AD8504AD671CBCABB920CC7D07CA8B06658DB11AA78CE42
                                                                                  Malicious:false
                                                                                  Preview:............o.6.........I....d[.z.6l.=...dIV...q..0...Iyk.C..8.R...v\7.....u..'..r...=.w..W.}..V_....W7......~..........<..f.-.O...l....a.../....l.m.e..kv.Y.n...~......}...ww..uSt.U..o.O...G..4w..|...........]]..y../..W.n...........".y..WB.2*C.7..W.4.....M...I..\&.($...."'....Y.e..o.7y.K.......oZ2.?..qW.O.$.............<.kV`2)G..%,...2.."Q..M.....}g.M`qa.x.Z_....N"......~.~.....;..4.....XEX...B0.Q=.'...z.,.|.>.5..W.6..$\RaT.&.m.%.b.2.....5#[..\...z.j.j|......~RN....@p.C.1.j.}..}..Z..Co'.i.%.TZ...O=%.`.J+............Y|.....mp.6...;v...l?...!..?"Q....a....'.8...)..)7..N...B.8...Yj.?..........V../...g....C..i.....IN...P..P.@.....N..u/...FJ.A<N<..gD. #..6....N.F.....C......4..........?R@.K../-%..P...|.././.o..?#K......%..=.8;........J..............6"..2.........jI....A..W.3......[.....$...>.%iJ..g..A...._....B.>.r...G.5.....$.P[.....J..r.y.4.KE.Lj/)i".w..Ig./.k?.....l../Z.f......"|%.-..T.....).l."Q..j*>%..E.J6...l...^.f.=`%./.l......7$D

                                                                                  C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):353
                                                                                  Entropy (8bit):5.34941178027421
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:YEtITIMf+zA56s/utITIMFQdXQJjDrwv/utITIMX9E4GL56s/C:YWuIMqA56s/cuIMFU0Dkv/cuIMX6lL5M
                                                                                  MD5:674B2E0C8F1A8B69E6ED2F1852EA90D4
                                                                                  SHA1:4C5BE5EE06B9E003C3D7BE95EFC66308F903725C
                                                                                  SHA-256:E1B5562963AFEF23A730FC3466BB82DEC985B83F08ED557EBDC9854447F272F8
                                                                                  SHA-512:8B6799B13645A578142C72C2BD1E26497B66C0A31F30380C1F9289C999692CE4D02A9DC8D6BF4DD76027AF03C2BD14263B621903709EDCB00C84F02100C73FBC
                                                                                  Malicious:false
                                                                                  Preview:{"logTime": "0901/204602", "correlationVector":"e8x218j+d2SStZVkpLvIpx","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0901/204602", "correlationVector":"D0DA0AAF5DA74945BD2425A28BEB3057","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0901/204602", "correlationVector":"rQA6HT74DpI9FtRW7IHx4v","action":"EXTENSION_UPDATER", "result":""}.

                                                                                  C:\Users\user\AppData\Local\Temp\dbbdab58-2d03-491b-a810-2917fce8c7b1.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41902
                                                                                  Category:dropped
                                                                                  Size (bytes):76319
                                                                                  Entropy (8bit):7.996132588300074
                                                                                  Encrypted:true
                                                                                  SSDEEP:1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6w6DLZ8:GdS8scZNzFrMa4M+lK5/nEDd8
                                                                                  MD5:24439F0E82F6A60E541FB2697F02043F
                                                                                  SHA1:E3FAA84B0ED8CDD2268D53A0ECC6F3134D5EBD8F
                                                                                  SHA-256:B24DD5C374F8BB381A48605D183B6590245EE802C65F643632A3BE9BB1F313C5
                                                                                  SHA-512:8FD794657A9F80FDBC2350DC26A2C82DFD82266B934A4472B3319FDB870841C832137D4F5CE41D518859B8B1DA63031C6B7E750D301F87D6ECA45B958B147FCD
                                                                                  Malicious:false
                                                                                  Preview:...........m{..(.}...7.\...N.D*.w..m..q....%XfL.*I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'.*.."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g.*.^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

                                                                                  C:\Users\user\AppData\Local\Temp\e89d9b20-2f28-48d6-a6bd-1cfe946304bb.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
                                                                                  Category:dropped
                                                                                  Size (bytes):206855
                                                                                  Entropy (8bit):7.983996634657522
                                                                                  Encrypted:false
                                                                                  SSDEEP:3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
                                                                                  MD5:788DF0376CE061534448AA17288FEA95
                                                                                  SHA1:C3B9285574587B3D1950EE4A8D64145E93842AEB
                                                                                  SHA-256:B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
                                                                                  SHA-512:3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
                                                                                  Malicious:false
                                                                                  Preview:......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..*B.P..*(.................*.....................( ..................*.. .".... .".......(.. .".....*.. ....o......E.6... ..*..."........."J......Ah......@.@@....:@{6..wCp..3...((.(......................*...@..(...."....................*......*.. ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

                                                                                  C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                                                  Category:dropped
                                                                                  Size (bytes):32768
                                                                                  Entropy (8bit):0.4593089050301797
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                                                  MD5:D910AD167F0217587501FDCDB33CC544
                                                                                  SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                                                  SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                                                  SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                                                  Malicious:false
                                                                                  Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_734234763\9f551a28-4aa3-4e52-b93b-f4f8affc879f.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:Google Chrome extension, version 3
                                                                                  Category:dropped
                                                                                  Size (bytes):11185
                                                                                  Entropy (8bit):7.951995436832936
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                  MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                  SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                  SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                  SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                  Malicious:false
                                                                                  Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_734234763\CRX_INSTALL\_metadata\verified_contents.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1753
                                                                                  Entropy (8bit):5.8889033066924155
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
                                                                                  MD5:738E757B92939B24CDBBD0EFC2601315
                                                                                  SHA1:77058CBAFA625AAFBEA867052136C11AD3332143
                                                                                  SHA-256:D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
                                                                                  SHA-512:DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
                                                                                  Malicious:false
                                                                                  Preview:[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_734234763\CRX_INSTALL\content.js

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):9815
                                                                                  Entropy (8bit):6.1716321262973315
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
                                                                                  MD5:3D20584F7F6C8EAC79E17CCA4207FB79
                                                                                  SHA1:3C16DCC27AE52431C8CDD92FBAAB0341524D3092
                                                                                  SHA-256:0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
                                                                                  SHA-512:315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
                                                                                  Malicious:false
                                                                                  Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_734234763\CRX_INSTALL\content_new.js

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):10388
                                                                                  Entropy (8bit):6.174387413738973
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
                                                                                  MD5:3DE1E7D989C232FC1B58F4E32DE15D64
                                                                                  SHA1:42B152EA7E7F31A964914F344543B8BF14B5F558
                                                                                  SHA-256:D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
                                                                                  SHA-512:177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
                                                                                  Malicious:false
                                                                                  Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_734234763\CRX_INSTALL\manifest.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):962
                                                                                  Entropy (8bit):5.698567446030411
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
                                                                                  MD5:E805E9E69FD6ECDCA65136957B1FB3BE
                                                                                  SHA1:2356F60884130C86A45D4B232A26062C7830E622
                                                                                  SHA-256:5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
                                                                                  SHA-512:049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
                                                                                  Malicious:false
                                                                                  Preview:{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/*" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/*" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\9d0bfe10-b2dc-4894-87c3-b96e2de5fb30.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:Google Chrome extension, version 3
                                                                                  Category:dropped
                                                                                  Size (bytes):135751
                                                                                  Entropy (8bit):7.804610863392373
                                                                                  Encrypted:false
                                                                                  SSDEEP:1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
                                                                                  MD5:83EF25FBEE6866A64F09323BFE1536E0
                                                                                  SHA1:24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
                                                                                  SHA-256:F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
                                                                                  SHA-512:C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
                                                                                  Malicious:false
                                                                                  Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7..*.Kk?....]<.S(.....9}........$..6...:...9..b|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]..*..-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\128.png

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                  Category:dropped
                                                                                  Size (bytes):4982
                                                                                  Entropy (8bit):7.929761711048726
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
                                                                                  MD5:913064ADAAA4C4FA2A9D011B66B33183
                                                                                  SHA1:99EA751AC2597A080706C690612AEEEE43161FC1
                                                                                  SHA-256:AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
                                                                                  SHA-512:162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
                                                                                  Malicious:false
                                                                                  Preview:.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb*..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...*T.P.B...*Tx...=.Q..wv.w.....|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......|..}./.....e..,.K.1........W.u.v. ...\.o

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\af\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):908
                                                                                  Entropy (8bit):4.512512697156616
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
                                                                                  MD5:12403EBCCE3AE8287A9E823C0256D205
                                                                                  SHA1:C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
                                                                                  SHA-256:B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
                                                                                  SHA-512:153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\am\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1285
                                                                                  Entropy (8bit):4.702209356847184
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
                                                                                  MD5:9721EBCE89EC51EB2BAEB4159E2E4D8C
                                                                                  SHA1:58979859B28513608626B563138097DC19236F1F
                                                                                  SHA-256:3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
                                                                                  SHA-512:FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ar\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1244
                                                                                  Entropy (8bit):4.5533961615623735
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
                                                                                  MD5:3EC93EA8F8422FDA079F8E5B3F386A73
                                                                                  SHA1:24640131CCFB21D9BC3373C0661DA02D50350C15
                                                                                  SHA-256:ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
                                                                                  SHA-512:F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\az\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):977
                                                                                  Entropy (8bit):4.867640976960053
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
                                                                                  MD5:9A798FD298008074E59ECC253E2F2933
                                                                                  SHA1:1E93DA985E880F3D3350FC94F5CCC498EFC8C813
                                                                                  SHA-256:628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
                                                                                  SHA-512:9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\be\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):3107
                                                                                  Entropy (8bit):3.535189746470889
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
                                                                                  MD5:68884DFDA320B85F9FC5244C2DD00568
                                                                                  SHA1:FD9C01E03320560CBBB91DC3D1917C96D792A549
                                                                                  SHA-256:DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
                                                                                  SHA-512:7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\bg\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1389
                                                                                  Entropy (8bit):4.561317517930672
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
                                                                                  MD5:2E6423F38E148AC5A5A041B1D5989CC0
                                                                                  SHA1:88966FFE39510C06CD9F710DFAC8545672FFDCEB
                                                                                  SHA-256:AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
                                                                                  SHA-512:891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\bn\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1763
                                                                                  Entropy (8bit):4.25392954144533
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
                                                                                  MD5:651375C6AF22E2BCD228347A45E3C2C9
                                                                                  SHA1:109AC3A912326171D77869854D7300385F6E628C
                                                                                  SHA-256:1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
                                                                                  SHA-512:958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ca\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):930
                                                                                  Entropy (8bit):4.569672473374877
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
                                                                                  MD5:D177261FFE5F8AB4B3796D26835F8331
                                                                                  SHA1:4BE708E2FFE0F018AC183003B74353AD646C1657
                                                                                  SHA-256:D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
                                                                                  SHA-512:E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\cs\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):913
                                                                                  Entropy (8bit):4.947221919047
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
                                                                                  MD5:CCB00C63E4814F7C46B06E4A142F2DE9
                                                                                  SHA1:860936B2A500CE09498B07A457E0CCA6B69C5C23
                                                                                  SHA-256:21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
                                                                                  SHA-512:35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\cy\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):806
                                                                                  Entropy (8bit):4.815663786215102
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
                                                                                  MD5:A86407C6F20818972B80B9384ACFBBED
                                                                                  SHA1:D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
                                                                                  SHA-256:A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
                                                                                  SHA-512:D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\da\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):883
                                                                                  Entropy (8bit):4.5096240460083905
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
                                                                                  MD5:B922F7FD0E8CCAC31B411FC26542C5BA
                                                                                  SHA1:2D25E153983E311E44A3A348B7D97AF9AAD21A30
                                                                                  SHA-256:48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
                                                                                  SHA-512:AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\de\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1031
                                                                                  Entropy (8bit):4.621865814402898
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
                                                                                  MD5:D116453277CC860D196887CEC6432FFE
                                                                                  SHA1:0AE00288FDE696795CC62FD36EABC507AB6F4EA4
                                                                                  SHA-256:36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
                                                                                  SHA-512:C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\el\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1613
                                                                                  Entropy (8bit):4.618182455684241
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
                                                                                  MD5:9ABA4337C670C6349BA38FDDC27C2106
                                                                                  SHA1:1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
                                                                                  SHA-256:37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
                                                                                  SHA-512:8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\en\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):851
                                                                                  Entropy (8bit):4.4858053753176526
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                  MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                  SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                  SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                  SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\en_CA\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):851
                                                                                  Entropy (8bit):4.4858053753176526
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                  MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                  SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                  SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                  SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\en_GB\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):848
                                                                                  Entropy (8bit):4.494568170878587
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
                                                                                  MD5:3734D498FB377CF5E4E2508B8131C0FA
                                                                                  SHA1:AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
                                                                                  SHA-256:AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
                                                                                  SHA-512:56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\en_US\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1425
                                                                                  Entropy (8bit):4.461560329690825
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
                                                                                  MD5:578215FBB8C12CB7E6CD73FBD16EC994
                                                                                  SHA1:9471D71FA6D82CE1863B74E24237AD4FD9477187
                                                                                  SHA-256:102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
                                                                                  SHA-512:E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
                                                                                  Malicious:false
                                                                                  Preview:{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\es\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):961
                                                                                  Entropy (8bit):4.537633413451255
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
                                                                                  MD5:F61916A206AC0E971CDCB63B29E580E3
                                                                                  SHA1:994B8C985DC1E161655D6E553146FB84D0030619
                                                                                  SHA-256:2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
                                                                                  SHA-512:D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\es_419\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):959
                                                                                  Entropy (8bit):4.570019855018913
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
                                                                                  MD5:535331F8FB98894877811B14994FEA9D
                                                                                  SHA1:42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
                                                                                  SHA-256:90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
                                                                                  SHA-512:2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\et\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):968
                                                                                  Entropy (8bit):4.633956349931516
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
                                                                                  MD5:64204786E7A7C1ED9C241F1C59B81007
                                                                                  SHA1:586528E87CD670249A44FB9C54B1796E40CDB794
                                                                                  SHA-256:CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
                                                                                  SHA-512:44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\eu\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):838
                                                                                  Entropy (8bit):4.4975520913636595
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
                                                                                  MD5:29A1DA4ACB4C9D04F080BB101E204E93
                                                                                  SHA1:2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
                                                                                  SHA-256:A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
                                                                                  SHA-512:B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\fa\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1305
                                                                                  Entropy (8bit):4.673517697192589
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
                                                                                  MD5:097F3BA8DE41A0AAF436C783DCFE7EF3
                                                                                  SHA1:986B8CABD794E08C7AD41F0F35C93E4824AC84DF
                                                                                  SHA-256:7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
                                                                                  SHA-512:8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\fi\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):911
                                                                                  Entropy (8bit):4.6294343834070935
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
                                                                                  MD5:B38CBD6C2C5BFAA6EE252D573A0B12A1
                                                                                  SHA1:2E490D5A4942D2455C3E751F96BD9960F93C4B60
                                                                                  SHA-256:2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
                                                                                  SHA-512:6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\fil\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):939
                                                                                  Entropy (8bit):4.451724169062555
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
                                                                                  MD5:FCEA43D62605860FFF41BE26BAD80169
                                                                                  SHA1:F25C2CE893D65666CC46EA267E3D1AA080A25F5B
                                                                                  SHA-256:F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
                                                                                  SHA-512:F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\fr\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):977
                                                                                  Entropy (8bit):4.622066056638277
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
                                                                                  MD5:A58C0EEBD5DC6BB5D91DAF923BD3A2AA
                                                                                  SHA1:F169870EEED333363950D0BCD5A46D712231E2AE
                                                                                  SHA-256:0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
                                                                                  SHA-512:B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\fr_CA\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):972
                                                                                  Entropy (8bit):4.621319511196614
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
                                                                                  MD5:6CAC04BDCC09034981B4AB567B00C296
                                                                                  SHA1:84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
                                                                                  SHA-256:4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
                                                                                  SHA-512:160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\gl\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):990
                                                                                  Entropy (8bit):4.497202347098541
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
                                                                                  MD5:6BAAFEE2F718BEFBC7CD58A04CCC6C92
                                                                                  SHA1:CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
                                                                                  SHA-256:0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
                                                                                  SHA-512:3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\gu\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1658
                                                                                  Entropy (8bit):4.294833932445159
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
                                                                                  MD5:BC7E1D09028B085B74CB4E04D8A90814
                                                                                  SHA1:E28B2919F000B41B41209E56B7BF3A4448456CFE
                                                                                  SHA-256:FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
                                                                                  SHA-512:040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\hi\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1672
                                                                                  Entropy (8bit):4.314484457325167
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
                                                                                  MD5:98A7FC3E2E05AFFFC1CFE4A029F47476
                                                                                  SHA1:A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
                                                                                  SHA-256:D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
                                                                                  SHA-512:457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\hr\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):935
                                                                                  Entropy (8bit):4.6369398601609735
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
                                                                                  MD5:25CDFF9D60C5FC4740A48EF9804BF5C7
                                                                                  SHA1:4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
                                                                                  SHA-256:73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
                                                                                  SHA-512:EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\hu\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1065
                                                                                  Entropy (8bit):4.816501737523951
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
                                                                                  MD5:8930A51E3ACE3DD897C9E61A2AEA1D02
                                                                                  SHA1:4108506500C68C054BA03310C49FA5B8EE246EA4
                                                                                  SHA-256:958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
                                                                                  SHA-512:126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\hy\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2771
                                                                                  Entropy (8bit):3.7629875118570055
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
                                                                                  MD5:55DE859AD778E0AA9D950EF505B29DA9
                                                                                  SHA1:4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
                                                                                  SHA-256:0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
                                                                                  SHA-512:EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\id\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):858
                                                                                  Entropy (8bit):4.474411340525479
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
                                                                                  MD5:34D6EE258AF9429465AE6A078C2FB1F5
                                                                                  SHA1:612CAE151984449A4346A66C0A0DF4235D64D932
                                                                                  SHA-256:E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
                                                                                  SHA-512:20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\is\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):954
                                                                                  Entropy (8bit):4.631887382471946
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
                                                                                  MD5:1F565FB1C549B18AF8BBFED8DECD5D94
                                                                                  SHA1:B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
                                                                                  SHA-256:E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
                                                                                  SHA-512:A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\it\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):899
                                                                                  Entropy (8bit):4.474743599345443
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
                                                                                  MD5:0D82B734EF045D5FE7AA680B6A12E711
                                                                                  SHA1:BD04F181E4EE09F02CD53161DCABCEF902423092
                                                                                  SHA-256:F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
                                                                                  SHA-512:01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\iw\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2230
                                                                                  Entropy (8bit):3.8239097369647634
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
                                                                                  MD5:26B1533C0852EE4661EC1A27BD87D6BF
                                                                                  SHA1:18234E3ABAF702DF9330552780C2F33B83A1188A
                                                                                  SHA-256:BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
                                                                                  SHA-512:450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ja\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1160
                                                                                  Entropy (8bit):5.292894989863142
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
                                                                                  MD5:15EC1963FC113D4AD6E7E59AE5DE7C0A
                                                                                  SHA1:4017FC6D8B302335469091B91D063B07C9E12109
                                                                                  SHA-256:34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
                                                                                  SHA-512:427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ka\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):3264
                                                                                  Entropy (8bit):3.586016059431306
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
                                                                                  MD5:83F81D30913DC4344573D7A58BD20D85
                                                                                  SHA1:5AD0E91EA18045232A8F9DF1627007FE506A70E0
                                                                                  SHA-256:30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
                                                                                  SHA-512:85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\kk\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):3235
                                                                                  Entropy (8bit):3.6081439490236464
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
                                                                                  MD5:2D94A58795F7B1E6E43C9656A147AD3C
                                                                                  SHA1:E377DB505C6924B6BFC9D73DC7C02610062F674E
                                                                                  SHA-256:548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
                                                                                  SHA-512:F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\km\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):3122
                                                                                  Entropy (8bit):3.891443295908904
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
                                                                                  MD5:B3699C20A94776A5C2F90AEF6EB0DAD9
                                                                                  SHA1:1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
                                                                                  SHA-256:A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
                                                                                  SHA-512:1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\kn\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1880
                                                                                  Entropy (8bit):4.295185867329351
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
                                                                                  MD5:8E16966E815C3C274EEB8492B1EA6648
                                                                                  SHA1:7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
                                                                                  SHA-256:418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
                                                                                  SHA-512:85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ko\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1042
                                                                                  Entropy (8bit):5.3945675025513955
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
                                                                                  MD5:F3E59EEEB007144EA26306C20E04C292
                                                                                  SHA1:83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
                                                                                  SHA-256:C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
                                                                                  SHA-512:7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\lo\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2535
                                                                                  Entropy (8bit):3.8479764584971368
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
                                                                                  MD5:E20D6C27840B406555E2F5091B118FC5
                                                                                  SHA1:0DCECC1A58CEB4936E255A64A2830956BFA6EC14
                                                                                  SHA-256:89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
                                                                                  SHA-512:AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\lt\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1028
                                                                                  Entropy (8bit):4.797571191712988
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
                                                                                  MD5:970544AB4622701FFDF66DC556847652
                                                                                  SHA1:14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
                                                                                  SHA-256:5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
                                                                                  SHA-512:CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\lv\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):994
                                                                                  Entropy (8bit):4.700308832360794
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
                                                                                  MD5:A568A58817375590007D1B8ABCAEBF82
                                                                                  SHA1:B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
                                                                                  SHA-256:0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
                                                                                  SHA-512:FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ml\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2091
                                                                                  Entropy (8bit):4.358252286391144
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
                                                                                  MD5:4717EFE4651F94EFF6ACB6653E868D1A
                                                                                  SHA1:B8A7703152767FBE1819808876D09D9CC1C44450
                                                                                  SHA-256:22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
                                                                                  SHA-512:487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\mn\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2778
                                                                                  Entropy (8bit):3.595196082412897
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
                                                                                  MD5:83E7A14B7FC60D4C66BF313C8A2BEF0B
                                                                                  SHA1:1CCF1D79CDED5D65439266DB58480089CC110B18
                                                                                  SHA-256:613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
                                                                                  SHA-512:3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\mr\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1719
                                                                                  Entropy (8bit):4.287702203591075
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
                                                                                  MD5:3B98C4ED8874A160C3789FEAD5553CFA
                                                                                  SHA1:5550D0EC548335293D962AAA96B6443DD8ABB9F6
                                                                                  SHA-256:ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
                                                                                  SHA-512:5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ms\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):936
                                                                                  Entropy (8bit):4.457879437756106
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
                                                                                  MD5:7D273824B1E22426C033FF5D8D7162B7
                                                                                  SHA1:EADBE9DBE5519BD60458B3551BDFC36A10049DD1
                                                                                  SHA-256:2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
                                                                                  SHA-512:E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\my\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):3830
                                                                                  Entropy (8bit):3.5483353063347587
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
                                                                                  MD5:342335A22F1886B8BC92008597326B24
                                                                                  SHA1:2CB04F892E430DCD7705C02BF0A8619354515513
                                                                                  SHA-256:243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
                                                                                  SHA-512:CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ne\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1898
                                                                                  Entropy (8bit):4.187050294267571
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
                                                                                  MD5:B1083DA5EC718D1F2F093BD3D1FB4F37
                                                                                  SHA1:74B6F050D918448396642765DEF1AD5390AB5282
                                                                                  SHA-256:E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
                                                                                  SHA-512:7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\nl\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):914
                                                                                  Entropy (8bit):4.513485418448461
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
                                                                                  MD5:32DF72F14BE59A9BC9777113A8B21DE6
                                                                                  SHA1:2A8D9B9A998453144307DD0B700A76E783062AD0
                                                                                  SHA-256:F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
                                                                                  SHA-512:E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\no\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):878
                                                                                  Entropy (8bit):4.4541485835627475
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
                                                                                  MD5:A1744B0F53CCF889955B95108367F9C8
                                                                                  SHA1:6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
                                                                                  SHA-256:21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
                                                                                  SHA-512:F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\pa\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2766
                                                                                  Entropy (8bit):3.839730779948262
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
                                                                                  MD5:97F769F51B83D35C260D1F8CFD7990AF
                                                                                  SHA1:0D59A76564B0AEE31D0A074305905472F740CECA
                                                                                  SHA-256:BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
                                                                                  SHA-512:D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\pl\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):978
                                                                                  Entropy (8bit):4.879137540019932
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
                                                                                  MD5:B8D55E4E3B9619784AECA61BA15C9C0F
                                                                                  SHA1:B4A9C9885FBEB78635957296FDDD12579FEFA033
                                                                                  SHA-256:E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
                                                                                  SHA-512:266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\pt_BR\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):907
                                                                                  Entropy (8bit):4.599411354657937
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
                                                                                  MD5:608551F7026E6BA8C0CF85D9AC11F8E3
                                                                                  SHA1:87B017B2D4DA17E322AF6384F82B57B807628617
                                                                                  SHA-256:A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
                                                                                  SHA-512:82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\pt_PT\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):914
                                                                                  Entropy (8bit):4.604761241355716
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
                                                                                  MD5:0963F2F3641A62A78B02825F6FA3941C
                                                                                  SHA1:7E6972BEAB3D18E49857079A24FB9336BC4D2D48
                                                                                  SHA-256:E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
                                                                                  SHA-512:22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ro\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):937
                                                                                  Entropy (8bit):4.686555713975264
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
                                                                                  MD5:BED8332AB788098D276B448EC2B33351
                                                                                  SHA1:6084124A2B32F386967DA980CBE79DD86742859E
                                                                                  SHA-256:085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
                                                                                  SHA-512:22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ru\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1337
                                                                                  Entropy (8bit):4.69531415794894
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
                                                                                  MD5:51D34FE303D0C90EE409A2397FCA437D
                                                                                  SHA1:B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
                                                                                  SHA-256:BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
                                                                                  SHA-512:E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\si\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2846
                                                                                  Entropy (8bit):3.7416822879702547
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
                                                                                  MD5:B8A4FD612534A171A9A03C1984BB4BDD
                                                                                  SHA1:F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
                                                                                  SHA-256:54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
                                                                                  SHA-512:C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\sk\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):934
                                                                                  Entropy (8bit):4.882122893545996
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
                                                                                  MD5:8E55817BF7A87052F11FE554A61C52D5
                                                                                  SHA1:9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
                                                                                  SHA-256:903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
                                                                                  SHA-512:EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\sl\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):963
                                                                                  Entropy (8bit):4.6041913416245
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
                                                                                  MD5:BFAEFEFF32813DF91C56B71B79EC2AF4
                                                                                  SHA1:F8EDA2B632610972B581724D6B2F9782AC37377B
                                                                                  SHA-256:AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
                                                                                  SHA-512:971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\sr\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1320
                                                                                  Entropy (8bit):4.569671329405572
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
                                                                                  MD5:7F5F8933D2D078618496C67526A2B066
                                                                                  SHA1:B7050E3EFA4D39548577CF47CB119FA0E246B7A4
                                                                                  SHA-256:4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
                                                                                  SHA-512:0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\sv\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):884
                                                                                  Entropy (8bit):4.627108704340797
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
                                                                                  MD5:90D8FB448CE9C0B9BA3D07FB8DE6D7EE
                                                                                  SHA1:D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
                                                                                  SHA-256:64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
                                                                                  SHA-512:6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\sw\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):980
                                                                                  Entropy (8bit):4.50673686618174
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
                                                                                  MD5:D0579209686889E079D87C23817EDDD5
                                                                                  SHA1:C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
                                                                                  SHA-256:0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
                                                                                  SHA-512:D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ta\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1941
                                                                                  Entropy (8bit):4.132139619026436
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
                                                                                  MD5:DCC0D1725AEAEAAF1690EF8053529601
                                                                                  SHA1:BB9D31859469760AC93E84B70B57909DCC02EA65
                                                                                  SHA-256:6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
                                                                                  SHA-512:6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\te\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1969
                                                                                  Entropy (8bit):4.327258153043599
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
                                                                                  MD5:385E65EF723F1C4018EEE6E4E56BC03F
                                                                                  SHA1:0CEA195638A403FD99BAEF88A360BD746C21DF42
                                                                                  SHA-256:026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
                                                                                  SHA-512:E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\th\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1674
                                                                                  Entropy (8bit):4.343724179386811
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
                                                                                  MD5:64077E3D186E585A8BEA86FF415AA19D
                                                                                  SHA1:73A861AC810DABB4CE63AD052E6E1834F8CA0E65
                                                                                  SHA-256:D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
                                                                                  SHA-512:56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\tr\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1063
                                                                                  Entropy (8bit):4.853399816115876
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
                                                                                  MD5:76B59AAACC7B469792694CF3855D3F4C
                                                                                  SHA1:7C04A2C1C808FA57057A4CCEEE66855251A3C231
                                                                                  SHA-256:B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
                                                                                  SHA-512:2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\uk\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1333
                                                                                  Entropy (8bit):4.686760246306605
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
                                                                                  MD5:970963C25C2CEF16BB6F60952E103105
                                                                                  SHA1:BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
                                                                                  SHA-256:9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
                                                                                  SHA-512:1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\ur\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1263
                                                                                  Entropy (8bit):4.861856182762435
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
                                                                                  MD5:8B4DF6A9281333341C939C244DDB7648
                                                                                  SHA1:382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
                                                                                  SHA-256:5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
                                                                                  SHA-512:FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\vi\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1074
                                                                                  Entropy (8bit):5.062722522759407
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
                                                                                  MD5:773A3B9E708D052D6CBAA6D55C8A5438
                                                                                  SHA1:5617235844595D5C73961A2C0A4AC66D8EA5F90F
                                                                                  SHA-256:597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
                                                                                  SHA-512:E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\zh_CN\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):879
                                                                                  Entropy (8bit):5.7905809868505544
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
                                                                                  MD5:3E76788E17E62FB49FB5ED5F4E7A3DCE
                                                                                  SHA1:6904FFA0D13D45496F126E58C886C35366EFCC11
                                                                                  SHA-256:E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
                                                                                  SHA-512:F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\zh_HK\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):1205
                                                                                  Entropy (8bit):4.50367724745418
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
                                                                                  MD5:524E1B2A370D0E71342D05DDE3D3E774
                                                                                  SHA1:60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
                                                                                  SHA-256:30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
                                                                                  SHA-512:D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\zh_TW\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):843
                                                                                  Entropy (8bit):5.76581227215314
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
                                                                                  MD5:0E60627ACFD18F44D4DF469D8DCE6D30
                                                                                  SHA1:2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
                                                                                  SHA-256:F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
                                                                                  SHA-512:6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
                                                                                  Malicious:false
                                                                                  Preview:{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_locales\zu\messages.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):912
                                                                                  Entropy (8bit):4.65963951143349
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
                                                                                  MD5:71F916A64F98B6D1B5D1F62D297FDEC1
                                                                                  SHA1:9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
                                                                                  SHA-256:EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
                                                                                  SHA-512:30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
                                                                                  Malicious:false
                                                                                  Preview:{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\_metadata\verified_contents.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):11280
                                                                                  Entropy (8bit):5.754230909218899
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
                                                                                  MD5:BE5DB35513DDEF454CE3502B6418B9B4
                                                                                  SHA1:C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
                                                                                  SHA-256:C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
                                                                                  SHA-512:38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
                                                                                  Malicious:false
                                                                                  Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\dasherSettingSchema.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):854
                                                                                  Entropy (8bit):4.284628987131403
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
                                                                                  MD5:4EC1DF2DA46182103D2FFC3B92D20CA5
                                                                                  SHA1:FB9D1BA3710CF31A87165317C6EDC110E98994CE
                                                                                  SHA-256:6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
                                                                                  SHA-512:939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
                                                                                  Malicious:false
                                                                                  Preview:{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\manifest.json

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):2525
                                                                                  Entropy (8bit):5.417689528134667
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
                                                                                  MD5:10FF8E5B674311683D27CE1879384954
                                                                                  SHA1:9C269C14E067BB86642EB9F4816D75CF1B9B9158
                                                                                  SHA-256:17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
                                                                                  SHA-512:4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
                                                                                  Malicious:false
                                                                                  Preview:{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/*", "https://drive.google.com/*", "https://drive-autopush.corp.google.com/*", "https://drive-daily-0.corp.google.com/*", "https://drive-daily-1.corp.google.com/*", "https://drive-daily-2.corp.google.com/*", "https://drive-daily-3.corp.google.com/*", "https://drive-daily-4.corp.google.com/*", "https://drive-daily-5.corp.google.com/*", "https://drive-daily-6.corp.google.com/*", "https://drive-preprod.corp.google.com/*", "https://drive-staging.corp.google.com/*" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\offscreendocument.html

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:HTML document, ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):97
                                                                                  Entropy (8bit):4.862433271815736
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
                                                                                  MD5:B747B5922A0BC74BBF0A9BC59DF7685F
                                                                                  SHA1:7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
                                                                                  SHA-256:B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
                                                                                  SHA-512:7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
                                                                                  Malicious:false
                                                                                  Preview:<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\offscreendocument_main.js

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with very long lines (4369)
                                                                                  Category:dropped
                                                                                  Size (bytes):95567
                                                                                  Entropy (8bit):5.4016395763198135
                                                                                  Encrypted:false
                                                                                  SSDEEP:1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
                                                                                  MD5:09AF2D8CFA8BF1078101DA78D09C4174
                                                                                  SHA1:F2369551E2CDD86258062BEB0729EE4D93FCA050
                                                                                  SHA-256:39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
                                                                                  SHA-512:F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
                                                                                  Malicious:false
                                                                                  Preview:'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\page_embed_script.js

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):291
                                                                                  Entropy (8bit):4.65176400421739
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
                                                                                  MD5:3AB0CD0F493B1B185B42AD38AE2DD572
                                                                                  SHA1:079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
                                                                                  SHA-256:73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
                                                                                  SHA-512:32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
                                                                                  Malicious:false
                                                                                  Preview:(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

                                                                                  C:\Users\user\AppData\Local\Temp\scoped_dir7628_808098504\CRX_INSTALL\service_worker_bin_prod.js

                                                                                  Download File
                                                                                  Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  File Type:ASCII text, with very long lines (4369)
                                                                                  Category:dropped
                                                                                  Size (bytes):103988
                                                                                  Entropy (8bit):5.389407461078688
                                                                                  Encrypted:false
                                                                                  SSDEEP:1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
                                                                                  MD5:EA946F110850F17E637B15CF22B82837
                                                                                  SHA1:8D27C963E76E3D2F5B8634EE66706F95F000FCAF
                                                                                  SHA-256:029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
                                                                                  SHA-512:5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
                                                                                  Malicious:false
                                                                                  Preview:'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g

                                                                                  C:\Users\user\AppData\Local\Temp\tmpaddon

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                  Category:dropped
                                                                                  Size (bytes):453023
                                                                                  Entropy (8bit):7.997718157581587
                                                                                  Encrypted:true
                                                                                  SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
                                                                                  MD5:85430BAED3398695717B0263807CF97C
                                                                                  SHA1:FFFBEE923CEA216F50FCE5D54219A188A5100F41
                                                                                  SHA-256:A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
                                                                                  SHA-512:06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
                                                                                  Malicious:false
                                                                                  Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):3621
                                                                                  Entropy (8bit):4.930166556735738
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNx9n:8S+OfJQPUFpOdwNIOdYVjvYcXaNLS48P
                                                                                  MD5:5DA7CBB569D2BFD41680091DBDCC2D5E
                                                                                  SHA1:F7FFF22A3F9238FAA6EADE8BCD5F7CBAA1B55DA7
                                                                                  SHA-256:A4E5F97F7B484CD789587160407EAC5A4981C3576F61B97C6ED9E41C53D8C8A5
                                                                                  SHA-512:3E30514D02083BD384715A2EBB64E931438BD272CF26BC47527298807DD9474DD0618ABC3D5E576994BFBA1D7B8F23E01C1E4E8332239ADC34DC4F92C73E52F1
                                                                                  Malicious:false
                                                                                  Preview:{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):3621
                                                                                  Entropy (8bit):4.930166556735738
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNx9n:8S+OfJQPUFpOdwNIOdYVjvYcXaNLS48P
                                                                                  MD5:5DA7CBB569D2BFD41680091DBDCC2D5E
                                                                                  SHA1:F7FFF22A3F9238FAA6EADE8BCD5F7CBAA1B55DA7
                                                                                  SHA-256:A4E5F97F7B484CD789587160407EAC5A4981C3576F61B97C6ED9E41C53D8C8A5
                                                                                  SHA-512:3E30514D02083BD384715A2EBB64E931438BD272CF26BC47527298807DD9474DD0618ABC3D5E576994BFBA1D7B8F23E01C1E4E8332239ADC34DC4F92C73E52F1
                                                                                  Malicious:false
                                                                                  Preview:{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:Mozilla lz4 compressed data, originally 23432 bytes
                                                                                  Category:dropped
                                                                                  Size (bytes):5312
                                                                                  Entropy (8bit):6.615424734763731
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
                                                                                  MD5:1B9C8056D3619CE5A8C59B0C09873F17
                                                                                  SHA1:1015C630E1937AA63F6AB31743782ECB5D78CCD8
                                                                                  SHA-256:A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
                                                                                  SHA-512:B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
                                                                                  Malicious:false
                                                                                  Preview:mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:Mozilla lz4 compressed data, originally 23432 bytes
                                                                                  Category:dropped
                                                                                  Size (bytes):5312
                                                                                  Entropy (8bit):6.615424734763731
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
                                                                                  MD5:1B9C8056D3619CE5A8C59B0C09873F17
                                                                                  SHA1:1015C630E1937AA63F6AB31743782ECB5D78CCD8
                                                                                  SHA-256:A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
                                                                                  SHA-512:B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
                                                                                  Malicious:false
                                                                                  Preview:mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):24
                                                                                  Entropy (8bit):3.91829583405449
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                  MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                  SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                  SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                  SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                  Malicious:false
                                                                                  Preview:{"schema":6,"addons":[]}

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):24
                                                                                  Entropy (8bit):3.91829583405449
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                  MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                  SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                  SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                  SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                  Malicious:false
                                                                                  Preview:{"schema":6,"addons":[]}

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 5
                                                                                  Category:dropped
                                                                                  Size (bytes):262144
                                                                                  Entropy (8bit):0.04905391753567332
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5
                                                                                  MD5:DD9D28E87ED57D16E65B14501B4E54D1
                                                                                  SHA1:793839B47326441BE2D1336BA9A61C9B948C578D
                                                                                  SHA-256:BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC
                                                                                  SHA-512:A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                  Category:dropped
                                                                                  Size (bytes):66
                                                                                  Entropy (8bit):4.837595020998689
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                  MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                  SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                  SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                  SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                  Malicious:false
                                                                                  Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                  Category:dropped
                                                                                  Size (bytes):66
                                                                                  Entropy (8bit):4.837595020998689
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                  MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                  SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                  SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                  SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                  Malicious:false
                                                                                  Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):36830
                                                                                  Entropy (8bit):5.185924656884556
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
                                                                                  MD5:5656BA69BD2966108A461AAE35F60226
                                                                                  SHA1:9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
                                                                                  SHA-256:587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
                                                                                  SHA-512:38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
                                                                                  Malicious:false
                                                                                  Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):36830
                                                                                  Entropy (8bit):5.185924656884556
                                                                                  Encrypted:false
                                                                                  SSDEEP:768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
                                                                                  MD5:5656BA69BD2966108A461AAE35F60226
                                                                                  SHA1:9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
                                                                                  SHA-256:587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
                                                                                  SHA-512:38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
                                                                                  Malicious:false
                                                                                  Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):32768
                                                                                  Entropy (8bit):0.017262956703125623
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                  MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                  SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                  SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                  SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                  Malicious:false
                                                                                  Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                  Category:dropped
                                                                                  Size (bytes):1021904
                                                                                  Entropy (8bit):6.648417932394748
                                                                                  Encrypted:false
                                                                                  SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                  MD5:FE3355639648C417E8307C6D051E3E37
                                                                                  SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                  SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                  SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                  Malicious:false
                                                                                  Antivirus:
                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                  Joe Sandbox View:
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zip, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                  Category:dropped
                                                                                  Size (bytes):1021904
                                                                                  Entropy (8bit):6.648417932394748
                                                                                  Encrypted:false
                                                                                  SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                  MD5:FE3355639648C417E8307C6D051E3E37
                                                                                  SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                  SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                  SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                  Malicious:false
                                                                                  Antivirus:
                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                  Joe Sandbox View:
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  • Filename: MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zip, Detection: malicious, Browse
                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):116
                                                                                  Entropy (8bit):4.968220104601006
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                  MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                  SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                  SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                  SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                  Malicious:false
                                                                                  Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):116
                                                                                  Entropy (8bit):4.968220104601006
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                  MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                  SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                  SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                  SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                  Malicious:false
                                                                                  Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):32768
                                                                                  Entropy (8bit):0.035577876577226504
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:GtlstFPz2BqBW1lstFPz2BqB789//alEl:GtWt6cW1Wt6c789XuM
                                                                                  MD5:EDEDFBD6FAC316579990989272F13465
                                                                                  SHA1:29CF0BF28F5A5D3CAE050ABD033C52137CBB083D
                                                                                  SHA-256:CE42ABBFCBD660E77C042F6804FEF5F7B6907AA0CF394597D174296F142C8D14
                                                                                  SHA-512:BF211A58FD4AAC9513FE6A1C77A424F5A07BE0B8CCDB5FF6A5B31188CBEB23126C57CD0C6EA770DB5C0927EB584D1168D8557371963BCC1A8DFAECED818E6974
                                                                                  Malicious:false
                                                                                  Preview:..-.....................X.C=y.}..8."x..R...X.Q."..-.....................X.C=y.}..8."x..R...X.Q."........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:SQLite Write-Ahead Log, version 3007000
                                                                                  Category:dropped
                                                                                  Size (bytes):32824
                                                                                  Entropy (8bit):0.03981530433941745
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Ol1qa5BdWmLollfuMLXLeh7l8rEXsxdwhml8XW3R2:KciomLojLetl8dMhm93w
                                                                                  MD5:56A4F407200088244DFB6B563800310F
                                                                                  SHA1:10AA0F6A418A026F2BE8CF7D0CA14DEBA6E0A1DC
                                                                                  SHA-256:DA8230550DDD0FADC0ABC36E07090063D759BC274FDB710836CE5ECCA00491FF
                                                                                  SHA-512:19899EF57A8D735B3B9CFF2FA384BB2DC4F92DEB36FFF6473448E6118A814F549AF571A931572A899ABEC6E307DFBB697765964F6DF51DC2023CBC8074485A45
                                                                                  Malicious:false
                                                                                  Preview:7....-...........8."x..R.T;..............8."x..R=C.X.}.y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:ASCII text, with very long lines (1809), with CRLF line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):13245
                                                                                  Entropy (8bit):5.493865973259955
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:RnaRtLYbBp6R5hj4qyaaXc6KgeNK75RfGNBw8d1Sl:cepqovKgcwS0
                                                                                  MD5:789792238DFF2870E9159A7E532C4385
                                                                                  SHA1:6DE3AC94318E0C23960C5C77C1FA26A556A4375F
                                                                                  SHA-256:20448E6494C75E7212C6C8C719821126E49429FF3AF9C794497BB53D1346B638
                                                                                  SHA-512:E590C0AD152BDFE8845ECA78140E352D00395F1D8AEFB9A2792F1511FE056FB1AEB5F64414924FD4A3E12F609B5302851C73D540B0EB1C080B2EC84780B9E171
                                                                                  Malicious:false
                                                                                  Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1725230144);..user_pref("app.update.lastUpdateTime.background-update-timer", 1725230144);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..u

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:ASCII text, with very long lines (1809), with CRLF line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):13245
                                                                                  Entropy (8bit):5.493865973259955
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:RnaRtLYbBp6R5hj4qyaaXc6KgeNK75RfGNBw8d1Sl:cepqovKgcwS0
                                                                                  MD5:789792238DFF2870E9159A7E532C4385
                                                                                  SHA1:6DE3AC94318E0C23960C5C77C1FA26A556A4375F
                                                                                  SHA-256:20448E6494C75E7212C6C8C719821126E49429FF3AF9C794497BB53D1346B638
                                                                                  SHA-512:E590C0AD152BDFE8845ECA78140E352D00395F1D8AEFB9A2792F1511FE056FB1AEB5F64414924FD4A3E12F609B5302851C73D540B0EB1C080B2EC84780B9E171
                                                                                  Malicious:false
                                                                                  Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1725230144);..user_pref("app.update.lastUpdateTime.background-update-timer", 1725230144);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..u

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 5
                                                                                  Category:dropped
                                                                                  Size (bytes):65536
                                                                                  Entropy (8bit):0.04062825861060003
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:ltBl/l4/WN1h4BEJYqWvLue3FMOrMZ0l:DBl/WuntfJiFxMZO
                                                                                  MD5:18F65713B07CB441E6A98655B726D098
                                                                                  SHA1:2CEFA32BC26B25BE81C411B60C9925CB0F1F8F88
                                                                                  SHA-256:B6C268E48546B113551A5AF9CA86BB6A462A512DE6C9289315E125CEB0FD8621
                                                                                  SHA-512:A6871076C7D7ED53B630F9F144ED04303AD54A2E60B94ECA2AA96964D1AB375EEFDCA86CE0D3EB0E9DBB81470C6BD159877125A080C95EB17E54A52427F805FB
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):90
                                                                                  Entropy (8bit):4.194538242412464
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                  MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                  SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                  SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                  SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                  Malicious:false
                                                                                  Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):90
                                                                                  Entropy (8bit):4.194538242412464
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                  MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                  SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                  SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                  SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                  Malicious:false
                                                                                  Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.baklz4 (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:Mozilla lz4 compressed data, originally 5952 bytes
                                                                                  Category:dropped
                                                                                  Size (bytes):1589
                                                                                  Entropy (8bit):6.322228671223231
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:vIKSUGu5kLZ8DLXHeU7+Au3maT5s+wHVQj60o0NjhWyOcUVHp/vRmN4r0a864:wKpR5SqzeU7wdCH0o0NGVO5F64
                                                                                  MD5:9D5F7C45D95326FCA2339D7CAAAAD757
                                                                                  SHA1:8A6947966DCA9E4AB6A5EE89D8A95F29B0BB75EE
                                                                                  SHA-256:DB3E0BC441973116CBFFDCBB210EF1E0511B69E1D430A1DF7F86DF344B69BC02
                                                                                  SHA-512:B2469703D2A3DDE7F6C6C9B49A2659A1BE2016B0A5E678E3BF7D8BE2129B235B21CC109D04EEE3CD68433633E32F035976CFA02387371AEEAD5E1A66CE382076
                                                                                  Malicious:false
                                                                                  Preview:mozLz40.@.....{"version":["ses....restore",1],"windows":[{"tab..bentrie...!url":"https://accounts.google.com/ServiceLogin?s...=)...ettings&continue=J....v3/signin/challenge/pwd","title..p..cacheKey":0,"ID":6,"docshellUU...D"{5cef1daa-0492-4eea-a916-99342602502b}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1725230187592,"hiddey..searchMode...userContextId...attribut;..{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedT..@],"_...C..`GroupC...":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace:...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...W...l...........:....1":{..mUpdate...startTim..P10603...centCrash..B0},".....Dcook1. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI|.Recure...,..Donly..fexpiry.

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:Mozilla lz4 compressed data, originally 5952 bytes
                                                                                  Category:dropped
                                                                                  Size (bytes):1589
                                                                                  Entropy (8bit):6.322228671223231
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:vIKSUGu5kLZ8DLXHeU7+Au3maT5s+wHVQj60o0NjhWyOcUVHp/vRmN4r0a864:wKpR5SqzeU7wdCH0o0NGVO5F64
                                                                                  MD5:9D5F7C45D95326FCA2339D7CAAAAD757
                                                                                  SHA1:8A6947966DCA9E4AB6A5EE89D8A95F29B0BB75EE
                                                                                  SHA-256:DB3E0BC441973116CBFFDCBB210EF1E0511B69E1D430A1DF7F86DF344B69BC02
                                                                                  SHA-512:B2469703D2A3DDE7F6C6C9B49A2659A1BE2016B0A5E678E3BF7D8BE2129B235B21CC109D04EEE3CD68433633E32F035976CFA02387371AEEAD5E1A66CE382076
                                                                                  Malicious:false
                                                                                  Preview:mozLz40.@.....{"version":["ses....restore",1],"windows":[{"tab..bentrie...!url":"https://accounts.google.com/ServiceLogin?s...=)...ettings&continue=J....v3/signin/challenge/pwd","title..p..cacheKey":0,"ID":6,"docshellUU...D"{5cef1daa-0492-4eea-a916-99342602502b}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1725230187592,"hiddey..searchMode...userContextId...attribut;..{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedT..@],"_...C..`GroupC...":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace:...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...W...l...........:....1":{..mUpdate...startTim..P10603...centCrash..B0},".....Dcook1. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI|.Recure...,..Donly..fexpiry.

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:Mozilla lz4 compressed data, originally 5952 bytes
                                                                                  Category:modified
                                                                                  Size (bytes):1589
                                                                                  Entropy (8bit):6.322228671223231
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:vIKSUGu5kLZ8DLXHeU7+Au3maT5s+wHVQj60o0NjhWyOcUVHp/vRmN4r0a864:wKpR5SqzeU7wdCH0o0NGVO5F64
                                                                                  MD5:9D5F7C45D95326FCA2339D7CAAAAD757
                                                                                  SHA1:8A6947966DCA9E4AB6A5EE89D8A95F29B0BB75EE
                                                                                  SHA-256:DB3E0BC441973116CBFFDCBB210EF1E0511B69E1D430A1DF7F86DF344B69BC02
                                                                                  SHA-512:B2469703D2A3DDE7F6C6C9B49A2659A1BE2016B0A5E678E3BF7D8BE2129B235B21CC109D04EEE3CD68433633E32F035976CFA02387371AEEAD5E1A66CE382076
                                                                                  Malicious:false
                                                                                  Preview:mozLz40.@.....{"version":["ses....restore",1],"windows":[{"tab..bentrie...!url":"https://accounts.google.com/ServiceLogin?s...=)...ettings&continue=J....v3/signin/challenge/pwd","title..p..cacheKey":0,"ID":6,"docshellUU...D"{5cef1daa-0492-4eea-a916-99342602502b}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1725230187592,"hiddey..searchMode...userContextId...attribut;..{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedT..@],"_...C..`GroupC...":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace:...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...W...l...........:....1":{..mUpdate...startTim..P10603...centCrash..B0},".....Dcook1. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI|.Recure...,..Donly..fexpiry.

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                                                  Category:dropped
                                                                                  Size (bytes):4096
                                                                                  Entropy (8bit):2.0836444556178684
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
                                                                                  MD5:8B40B1534FF0F4B533AF767EB5639A05
                                                                                  SHA1:63EDB539EA39AD09D701A36B535C4C087AE08CC9
                                                                                  SHA-256:AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
                                                                                  SHA-512:54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
                                                                                  Malicious:false
                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):4537
                                                                                  Entropy (8bit):5.034554795801647
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YrSAYu6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyJW:ycuyTEr5QFRzzcMvbw6KkCrrc2Rn27
                                                                                  MD5:82C3675A765B1F386237FABC54E81ABA
                                                                                  SHA1:E0E077FD3D725380096555868ECF0E244821723C
                                                                                  SHA-256:C4F371C1FA0F7241E148AC77C78C33B45B5FEBE665BB795D3B47E179465DF529
                                                                                  SHA-512:6959C5DCBC80539BD7BE2C2A6B70C671B741B114317964403B488D05A13A8729A83333A9D5382A7084A3C352376D097C0873D258441D69888A17B2B0817822A4
                                                                                  Malicious:false
                                                                                  Preview:{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-09-01T22:35:57.964Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  File Type:JSON data
                                                                                  Category:dropped
                                                                                  Size (bytes):4537
                                                                                  Entropy (8bit):5.034554795801647
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:YrSAYu6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyJW:ycuyTEr5QFRzzcMvbw6KkCrrc2Rn27
                                                                                  MD5:82C3675A765B1F386237FABC54E81ABA
                                                                                  SHA1:E0E077FD3D725380096555868ECF0E244821723C
                                                                                  SHA-256:C4F371C1FA0F7241E148AC77C78C33B45B5FEBE665BB795D3B47E179465DF529
                                                                                  SHA-512:6959C5DCBC80539BD7BE2C2A6B70C671B741B114317964403B488D05A13A8729A83333A9D5382A7084A3C352376D097C0873D258441D69888A17B2B0817822A4
                                                                                  Malicious:false
                                                                                  Preview:{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-09-01T22:35:57.964Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

                                                                                  Static File Info

                                                                                  General

                                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                  Entropy (8bit):6.579635240916889
                                                                                  TrID:
                                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                  File name:file.exe
                                                                                  File size:917'504 bytes
                                                                                  MD5:b129d4053a168a3d69fed0a5c1088353
                                                                                  SHA1:4e136ac4aad5dd4caec5b36436c9aa2ca0e46dbb
                                                                                  SHA256:c74e6420dd151177d9608cc9f7c4163cc86b1ed7e2a2655da309debd07d18e3e
                                                                                  SHA512:ffc2b4bce10231c82a35640d042372be93260a792ec9666ebf0ab8c7860db816894b9ad454d87f7791d8b490f8ab55087cb2ac0c9f61bd7b9d95007e69f28a09
                                                                                  SSDEEP:12288:KqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarT7:KqDEvCTbMWu7rQYlBQcBiT6rprG8av7
                                                                                  TLSH:88159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
                                                                                  File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                                                                  File Icon

                                                                                  Icon Hash:aaf3e3e3938382a0

                                                                                  Static PE Info

                                                                                  General

                                                                                  Entrypoint:0x420577
                                                                                  Entrypoint Section:.text
                                                                                  Digitally signed:false
                                                                                  Imagebase:0x400000
                                                                                  Subsystem:windows gui
                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                  DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                  Time Stamp:0x66D4CE16 [Sun Sep 1 20:27:02 2024 UTC]
                                                                                  TLS Callbacks:
                                                                                  CLR (.Net) Version:
                                                                                  OS Version Major:5
                                                                                  OS Version Minor:1
                                                                                  File Version Major:5
                                                                                  File Version Minor:1
                                                                                  Subsystem Version Major:5
                                                                                  Subsystem Version Minor:1
                                                                                  Import Hash:948cc502fe9226992dce9417f952fce3

                                                                                  Entrypoint Preview

                                                                                  Instruction
                                                                                  call 00007FC4C08EF0B3h
                                                                                  jmp 00007FC4C08EE9BFh
                                                                                  push ebp
                                                                                  mov ebp, esp
                                                                                  push esi
                                                                                  push dword ptr [ebp+08h]
                                                                                  mov esi, ecx
                                                                                  call 00007FC4C08EEB9Dh
                                                                                  mov dword ptr [esi], 0049FDF0h
                                                                                  mov eax, esi
                                                                                  pop esi
                                                                                  pop ebp
                                                                                  retn 0004h
                                                                                  and dword ptr [ecx+04h], 00000000h
                                                                                  mov eax, ecx
                                                                                  and dword ptr [ecx+08h], 00000000h
                                                                                  mov dword ptr [ecx+04h], 0049FDF8h
                                                                                  mov dword ptr [ecx], 0049FDF0h
                                                                                  ret
                                                                                  push ebp
                                                                                  mov ebp, esp
                                                                                  push esi
                                                                                  push dword ptr [ebp+08h]
                                                                                  mov esi, ecx
                                                                                  call 00007FC4C08EEB6Ah
                                                                                  mov dword ptr [esi], 0049FE0Ch
                                                                                  mov eax, esi
                                                                                  pop esi
                                                                                  pop ebp
                                                                                  retn 0004h
                                                                                  and dword ptr [ecx+04h], 00000000h
                                                                                  mov eax, ecx
                                                                                  and dword ptr [ecx+08h], 00000000h
                                                                                  mov dword ptr [ecx+04h], 0049FE14h
                                                                                  mov dword ptr [ecx], 0049FE0Ch
                                                                                  ret
                                                                                  push ebp
                                                                                  mov ebp, esp
                                                                                  push esi
                                                                                  mov esi, ecx
                                                                                  lea eax, dword ptr [esi+04h]
                                                                                  mov dword ptr [esi], 0049FDD0h
                                                                                  and dword ptr [eax], 00000000h
                                                                                  and dword ptr [eax+04h], 00000000h
                                                                                  push eax
                                                                                  mov eax, dword ptr [ebp+08h]
                                                                                  add eax, 04h
                                                                                  push eax
                                                                                  call 00007FC4C08F175Dh
                                                                                  pop ecx
                                                                                  pop ecx
                                                                                  mov eax, esi
                                                                                  pop esi
                                                                                  pop ebp
                                                                                  retn 0004h
                                                                                  lea eax, dword ptr [ecx+04h]
                                                                                  mov dword ptr [ecx], 0049FDD0h
                                                                                  push eax
                                                                                  call 00007FC4C08F17A8h
                                                                                  pop ecx
                                                                                  ret
                                                                                  push ebp
                                                                                  mov ebp, esp
                                                                                  push esi
                                                                                  mov esi, ecx
                                                                                  lea eax, dword ptr [esi+04h]
                                                                                  mov dword ptr [esi], 0049FDD0h
                                                                                  push eax
                                                                                  call 00007FC4C08F1791h
                                                                                  test byte ptr [ebp+08h], 00000001h
                                                                                  pop ecx

                                                                                  Rich Headers

                                                                                  Programming Language:
                                                                                  • [ C ] VS2008 SP1 build 30729
                                                                                  • [IMP] VS2008 SP1 build 30729

                                                                                  Data Directories

                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000x9500.rsrc
                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0xde0000x7594.reloc
                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                  Sections

                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                  .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                  .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                  .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                  .rsrc0xd40000x95000x960081304d9b3072e787af172e1bdca17d5bFalse0.28106770833333333data5.162457270512613IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                  .reloc0xde0000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                  Resources

                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                  RT_ICON0xd45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                  RT_ICON0xd46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                  RT_ICON0xd47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                  RT_ICON0xd49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                                  RT_ICON0xd4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                                  RT_ICON0xd4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                                  RT_ICON0xd5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                                  RT_ICON0xd64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                                  RT_ICON0xd69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                                  RT_ICON0xd8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                                  RT_ICON0xda0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                                  RT_MENU0xda4a00x50dataEnglishGreat Britain0.9
                                                                                  RT_STRING0xda4f00x594dataEnglishGreat Britain0.3333333333333333
                                                                                  RT_STRING0xdaa840x68adataEnglishGreat Britain0.2735961768219833
                                                                                  RT_STRING0xdb1100x490dataEnglishGreat Britain0.3715753424657534
                                                                                  RT_STRING0xdb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                  RT_STRING0xdbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                                                  RT_STRING0xdc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                                                  RT_STRING0xdc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                                  RT_RCDATA0xdc7b80x7c6data1.0055276381909548
                                                                                  RT_GROUP_ICON0xdcf800x76dataEnglishGreat Britain0.6610169491525424
                                                                                  RT_GROUP_ICON0xdcff80x14dataEnglishGreat Britain1.25
                                                                                  RT_GROUP_ICON0xdd00c0x14dataEnglishGreat Britain1.15
                                                                                  RT_GROUP_ICON0xdd0200x14dataEnglishGreat Britain1.25
                                                                                  RT_VERSION0xdd0340xdcdataEnglishGreat Britain0.6181818181818182
                                                                                  RT_MANIFEST0xdd1100x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                                                  Imports

                                                                                  DLLImport
                                                                                  WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                                                  VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                                                  WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                  COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                                                  MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                                                  WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                                                  PSAPI.DLLGetProcessMemoryInfo
                                                                                  IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                                                  USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                                                  UxTheme.dllIsThemeActive
                                                                                  KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                                                                                  USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                                                                                  GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                                                                                  COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                  ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                                                                                  SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                                                  ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                                                  OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                                                                                  Possible Origin

                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                  EnglishGreat Britain

                                                                                  Network Behavior

                                                                                  Network Port Distribution

                                                                                  TCP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  Sep 1, 2024 22:45:58.771363020 CEST49675443192.168.2.4173.222.162.32
                                                                                  Sep 1, 2024 22:46:00.774974108 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:00.775016069 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:00.775084019 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:00.775295019 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:00.775310040 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.422626019 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.423264980 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.423288107 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.423614025 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.423629999 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.423666954 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.423675060 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.423693895 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.423719883 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.424222946 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.429497957 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.429569006 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.430032969 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.430046082 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.574691057 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.695812941 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.695848942 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.695941925 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.695970058 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.698649883 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.700160980 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.700170040 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.704696894 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.705955029 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.705962896 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.771097898 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.811834097 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.812225103 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.812251091 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.812298059 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.812309027 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.812323093 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.812335014 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.813280106 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.813316107 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.813342094 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.813370943 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.813381910 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.813419104 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.814109087 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.814171076 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.814227104 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.814235926 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.814279079 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.814285040 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.815013885 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.815062046 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.815090895 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.815107107 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.815114975 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.815146923 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.815804958 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.815848112 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.815854073 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.816607952 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.816657066 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.816667080 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.817679882 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.819701910 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.819710016 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901549101 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901618958 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901648045 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901715994 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.901734114 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901745081 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.901875973 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901909113 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901921988 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.901928902 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901968002 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.901997089 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902009964 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.902015924 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902045965 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.902332067 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902364016 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902379990 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.902385950 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902425051 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.902430058 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902465105 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902617931 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902648926 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902674913 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.902683973 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902693033 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.902724981 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902759075 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902766943 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.902772903 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902815104 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.902821064 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.902873039 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903009892 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.903017044 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903466940 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903501034 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903525114 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.903533936 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903564930 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903578043 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.903587103 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903676987 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903707027 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903732061 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.903742075 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903750896 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.903774023 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903804064 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903827906 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903851986 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.903861046 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.903871059 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.904422045 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.904464006 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.904470921 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.907330036 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.907566071 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.907578945 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.910854101 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.910945892 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.910953045 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.911043882 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.913912058 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.913990974 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.913996935 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.946804047 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.946855068 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.946863890 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994371891 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994398117 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994446039 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.994469881 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994555950 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994587898 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994602919 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.994611025 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994637966 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.994903088 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994932890 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994963884 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.994963884 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.994973898 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995007038 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.995014906 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995043993 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995068073 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.995075941 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995126009 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.995131969 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995459080 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995490074 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995517015 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995546103 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995551109 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.995558023 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995573997 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.995610952 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.995615005 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995630026 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995667934 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.995672941 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995891094 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995913982 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.995951891 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.995956898 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.996166945 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.996440887 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:01.996471882 CEST44349743142.250.185.161192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.996532917 CEST49743443192.168.2.4142.250.185.161
                                                                                  Sep 1, 2024 22:46:02.663588047 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:02.669476032 CEST804975534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:02.669538021 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:02.669707060 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:02.675291061 CEST804975534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:02.876508951 CEST49756443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:02.876524925 CEST4434975635.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:02.876610041 CEST49756443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:02.882035971 CEST49756443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:02.882042885 CEST4434975635.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.100228071 CEST804975534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.192992926 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:03.282928944 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:03.287755013 CEST804975734.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.287846088 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:03.288034916 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:03.292886972 CEST804975734.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.529659033 CEST4434975635.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.529844999 CEST49756443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:03.532424927 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:03.532457113 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.532531023 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:03.533160925 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.533169031 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.533380985 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.533380985 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.533404112 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.533498049 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.533909082 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.533927917 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.534096956 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.534271955 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:03.534277916 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.534373045 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:03.541254044 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.541268110 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.541750908 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.541752100 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:03.541763067 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.541764975 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.541915894 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:03.541928053 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.543168068 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:03.543180943 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.554939985 CEST49756443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:03.554949045 CEST4434975635.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.555064917 CEST4434975635.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.555535078 CEST49763443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:03.555536032 CEST49756443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:03.555541992 CEST4434975635.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.555569887 CEST4434976335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.555571079 CEST49756443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:03.555651903 CEST49763443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:03.557864904 CEST49763443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:03.557882071 CEST4434976335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.641722918 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:03.641733885 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.641968012 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:03.642431021 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:03.642441988 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.753206968 CEST804975734.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.880748034 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:04.003922939 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.006587029 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.006606102 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.007453918 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.007534981 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.008627892 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.009608984 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.009670973 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.011291981 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:04.011292934 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.011297941 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.011300087 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.012152910 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.012222052 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:04.027117968 CEST4434976335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.027272940 CEST49763443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:04.043435097 CEST49763443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:04.043454885 CEST4434976335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.043570995 CEST4434976335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.043665886 CEST49763443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:04.043673992 CEST4434976335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.043694019 CEST49763443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:04.047513008 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:04.047571898 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.049072027 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:04.049082994 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.115118027 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.116312981 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.116322041 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.117449045 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.117563009 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.120078087 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.120166063 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.121568918 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.121576071 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.138063908 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.138729095 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.139419079 CEST49758443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.139434099 CEST44349758162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.154079914 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.160306931 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:04.161694050 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.180785894 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.181998014 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.193651915 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.226914883 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.226936102 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.227263927 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.227278948 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.227533102 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.227539062 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.227853060 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.227926970 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.228451014 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.228461027 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.228501081 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.228532076 CEST49762443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:04.228543043 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.228545904 CEST44349762172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.228573084 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.229794979 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.229861021 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.230220079 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.230298996 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.230710983 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.230770111 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.231210947 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.231220007 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.231350899 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.231353045 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.231357098 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.231363058 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.249085903 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.249164104 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.249483109 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.260900021 CEST49764443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:04.260906935 CEST44349764162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.286111116 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.327143908 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327169895 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327177048 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327199936 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327212095 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327224016 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327240944 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.327248096 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327296972 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.327521086 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327584028 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327589989 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327593088 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327611923 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327646017 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.327653885 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327661991 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.327671051 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.327677011 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.327701092 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.336800098 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.336815119 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.336894989 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.336913109 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.336924076 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.336960077 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.410748959 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.410754919 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.410773993 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.410783052 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.410808086 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.410815001 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.410849094 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.412153959 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.412175894 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.412184000 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.412204981 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.412209988 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.412216902 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.412220955 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.412259102 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.428574085 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.428581953 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.428613901 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.428627014 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.428637981 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.428649902 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.428672075 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.428698063 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.430480957 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.430488110 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.430511951 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.430536985 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.430541039 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.430552959 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.430582047 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.495606899 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.495644093 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.495692968 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.495699883 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.495743036 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.495768070 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.496539116 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.496556044 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.496603012 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.496608019 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.496651888 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.496659994 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.497654915 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.497669935 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.497747898 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.497754097 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.497797966 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.498589039 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.498605013 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.498680115 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.498686075 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.498744011 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.521574020 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.521593094 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.521612883 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.521651983 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.521666050 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.521682978 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.521847963 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.521853924 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.521892071 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.521905899 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.521939039 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.555900097 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.557250977 CEST49761443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.557257891 CEST4434976113.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.579483032 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:04.579730988 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.579745054 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.580594063 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.580621958 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.582010031 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.584984064 CEST804975534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.590466976 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.590466976 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.590473890 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.590502024 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.590529919 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.590584993 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.591697931 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.594144106 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.600728989 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.600733042 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.600924969 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.602400064 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.602469921 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.602576017 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.644373894 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.646822929 CEST49759443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.646837950 CEST4434975913.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.664001942 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.664016962 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.664493084 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.664519072 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.665029049 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.665044069 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.665530920 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.665572882 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.666052103 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.666073084 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.667022943 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.667114973 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.667876959 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.667944908 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.668605089 CEST49760443192.168.2.413.107.246.57
                                                                                  Sep 1, 2024 22:46:04.668616056 CEST4434976013.107.246.57192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.672112942 CEST804975534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.686434984 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:04.691181898 CEST804975734.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.786345959 CEST804975734.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.788718939 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:04.962358952 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:04.962403059 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.962997913 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:04.965634108 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:04.965652943 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:04.989334106 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:05.646584988 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.646761894 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:05.659095049 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:05.659133911 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.659326077 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.719167948 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:05.760509014 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.840364933 CEST49771443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.840389967 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.840537071 CEST49772443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.840564013 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.840645075 CEST49771443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.840648890 CEST49772443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.841068983 CEST49772443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.841078997 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.841176987 CEST49771443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.841190100 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.925909996 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.925947905 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.926132917 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:05.926628113 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:05.926645994 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.926752090 CEST49770443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:05.926758051 CEST44349770184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.997585058 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:05.997644901 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.004400969 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:06.005352974 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:06.005376101 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.256956100 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.256993055 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.257105112 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.257134914 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.260178089 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.260310888 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.260932922 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.260950089 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.261045933 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.261061907 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.294792891 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.304795980 CEST49771443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.304806948 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.305196047 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.308897972 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.318156004 CEST49772443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.318169117 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.318391085 CEST49771443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.318470955 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.318505049 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.328641891 CEST49772443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.328696966 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.394839048 CEST49772443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.471329927 CEST49771443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.704200029 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.704210997 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.712145090 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.713536978 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:06.714967966 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:06.714982986 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.715189934 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.740243912 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:06.741765976 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.741787910 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.742125034 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.742723942 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.743016005 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.743026972 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.748529911 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.748593092 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.748847008 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.761156082 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.780513048 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.791038036 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.791065931 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.835397959 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.835417032 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.835761070 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.835769892 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.836324930 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:06.836369991 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.836374044 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.836430073 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.836443901 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.836837053 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:06.836968899 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.840785980 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.840841055 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.840964079 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:06.840980053 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.841207981 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.855820894 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.859302998 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.869690895 CEST49774443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.869705915 CEST44349774142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.884504080 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.956721067 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.964154959 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:06.976620913 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.976665974 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.979098082 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:07.065759897 CEST49775443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.065784931 CEST44349775142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.071692944 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:07.071719885 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.071732044 CEST49773443192.168.2.4184.28.90.27
                                                                                  Sep 1, 2024 22:46:07.071738005 CEST44349773184.28.90.27192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.234292984 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.234324932 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.234671116 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.234874010 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.234889030 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.306489944 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.307596922 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:07.307610989 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.308655024 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.308711052 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:07.309691906 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:07.309748888 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.309875965 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:07.309883118 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.371853113 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:07.373364925 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.373395920 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.382720947 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.383333921 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.383348942 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.403961897 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.404009104 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.404038906 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.404063940 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.404160023 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.404268026 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:07.404947042 CEST49776443192.168.2.4142.250.65.196
                                                                                  Sep 1, 2024 22:46:07.404961109 CEST44349776142.250.65.196192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.720082998 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.726047039 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.726077080 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.726377010 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.726463079 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.726985931 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.727046013 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.727454901 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.727504969 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.847115040 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.847141027 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.882919073 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.883158922 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.883172989 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.883481026 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.883491039 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.883563995 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.884079933 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.884124041 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.884304047 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.884361029 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.988162994 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.988162994 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.988179922 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.084574938 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.084604979 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.084670067 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.084851980 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.084867954 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.088291883 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:08.526612043 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.526818991 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.526832104 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.527682066 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.527770996 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.528778076 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.528834105 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.528930902 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.573860884 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.573873043 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.658271074 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.658353090 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.659357071 CEST49779443192.168.2.4142.251.32.106
                                                                                  Sep 1, 2024 22:46:08.659373045 CEST44349779142.251.32.106192.168.2.4
                                                                                  Sep 1, 2024 22:46:11.346246958 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:11.346282959 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:11.346575022 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:11.347609997 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:11.347625971 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:12.019613028 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:12.019687891 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:12.022728920 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:12.022738934 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:12.022937059 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:12.066343069 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:12.859030962 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:12.904500961 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.072410107 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.072428942 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.072436094 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.072444916 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.072464943 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.074402094 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:13.074420929 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.074457884 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.074511051 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:13.823875904 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:13.823875904 CEST49780443192.168.2.413.85.23.86
                                                                                  Sep 1, 2024 22:46:13.823909998 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:13.823921919 CEST4434978013.85.23.86192.168.2.4
                                                                                  Sep 1, 2024 22:46:14.686614990 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:14.691392899 CEST804975534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:14.809063911 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:14.813863993 CEST804975734.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:19.266704082 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:19.266731024 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:19.266813993 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:19.267663002 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:19.267673016 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.663816929 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.664072037 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.664086103 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.664949894 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.665014982 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.666065931 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.666115046 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.666241884 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.712498903 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.721260071 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.721266985 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.768160105 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.777024031 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.778429031 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.778439045 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.778472900 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.778487921 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.778496981 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:20.778529882 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.778577089 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.779010057 CEST49786443192.168.2.4152.195.19.97
                                                                                  Sep 1, 2024 22:46:20.779019117 CEST44349786152.195.19.97192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.051706076 CEST49787443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.051734924 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.051873922 CEST49788443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.051897049 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.052377939 CEST49787443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.052489996 CEST49788443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.053122044 CEST49788443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.053134918 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.053236008 CEST49787443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.053247929 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.199414015 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.199485064 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.199628115 CEST49771443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:21.213211060 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.213278055 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.213366032 CEST49772443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:21.491429090 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.491854906 CEST49787443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.491882086 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.492158890 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.492516994 CEST49787443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.492578983 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.537539005 CEST49787443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.564110041 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.567610979 CEST49788443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.567620993 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.567953110 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.568361998 CEST49788443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.568424940 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.617230892 CEST49788443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:24.692656994 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:24.697865009 CEST804975534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:24.813477039 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:24.819065094 CEST804975734.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:28.633761883 CEST5043753192.168.2.4162.159.36.2
                                                                                  Sep 1, 2024 22:46:28.638560057 CEST5350437162.159.36.2192.168.2.4
                                                                                  Sep 1, 2024 22:46:28.638629913 CEST5043753192.168.2.4162.159.36.2
                                                                                  Sep 1, 2024 22:46:28.643903971 CEST5350437162.159.36.2192.168.2.4
                                                                                  Sep 1, 2024 22:46:29.093234062 CEST5043753192.168.2.4162.159.36.2
                                                                                  Sep 1, 2024 22:46:29.098499060 CEST5350437162.159.36.2192.168.2.4
                                                                                  Sep 1, 2024 22:46:29.098548889 CEST5043753192.168.2.4162.159.36.2
                                                                                  Sep 1, 2024 22:46:29.130568981 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:29.130610943 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:29.130871058 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:29.131222010 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:29.131237030 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:29.791258097 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:29.791333914 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:29.795073032 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:29.795084953 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:29.795322895 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:29.803057909 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:29.848501921 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.028116941 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.028184891 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.028289080 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:30.028316021 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.028335094 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:30.028342009 CEST4435043813.85.23.206192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.029287100 CEST50438443192.168.2.413.85.23.206
                                                                                  Sep 1, 2024 22:46:30.136737108 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:30.136774063 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.136850119 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:30.137170076 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:30.137187004 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.922270060 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.922337055 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:30.923465967 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:30.923477888 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.923710108 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:30.924694061 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:30.968508005 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:31.170192957 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:31.170268059 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:31.170341969 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:31.170377970 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:31.170398951 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:31.170412064 CEST50439443192.168.2.440.68.123.157
                                                                                  Sep 1, 2024 22:46:31.170418978 CEST4435043940.68.123.157192.168.2.4
                                                                                  Sep 1, 2024 22:46:33.487174988 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:33.487199068 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:33.487358093 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:33.487792969 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:33.487806082 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.187191963 CEST50441443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:34.187205076 CEST4435044134.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.187279940 CEST50441443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:34.187766075 CEST50441443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:34.187781096 CEST4435044134.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.189065933 CEST50442443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:34.189091921 CEST4435044235.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.189399004 CEST50442443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:34.189492941 CEST50442443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:34.189502954 CEST4435044235.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.213622093 CEST50443443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:34.213634968 CEST4435044335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.213830948 CEST50443443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:34.215250015 CEST50443443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:34.215259075 CEST4435044335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.263179064 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.263267040 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.264954090 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.264959097 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.265199900 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.266732931 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.312500954 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.331796885 CEST50444443192.168.2.418.65.39.112
                                                                                  Sep 1, 2024 22:46:34.331828117 CEST4435044418.65.39.112192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.332166910 CEST50444443192.168.2.418.65.39.112
                                                                                  Sep 1, 2024 22:46:34.332304955 CEST50444443192.168.2.418.65.39.112
                                                                                  Sep 1, 2024 22:46:34.332325935 CEST4435044418.65.39.112192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.596333981 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.596362114 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.596381903 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.596436024 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.596447945 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.596501112 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.596718073 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.596935034 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.600590944 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.600701094 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.600708008 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.600719929 CEST50440443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.600723982 CEST4435044020.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.651577950 CEST4435044335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.656500101 CEST4435044335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.658057928 CEST50443443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:34.658170938 CEST4435044235.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.660213947 CEST50442443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:34.662836075 CEST50442443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:34.662842035 CEST4435044235.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.663042068 CEST4435044235.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.668394089 CEST50443443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:34.668400049 CEST4435044335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.668521881 CEST50443443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:34.668529034 CEST4435044335.190.72.216192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.669171095 CEST50442443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:34.669245005 CEST50442443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:34.669294119 CEST4435044235.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.670284033 CEST50443443192.168.2.435.190.72.216
                                                                                  Sep 1, 2024 22:46:34.670300007 CEST50442443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:34.670718908 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:34.670748949 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:34.676156044 CEST804975734.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.676219940 CEST804975534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.676610947 CEST4975780192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:34.676620007 CEST4975580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:34.687695026 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:34.692511082 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.692744017 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:34.692903042 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:34.697633982 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.710237026 CEST4435044134.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.710416079 CEST50441443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:34.713470936 CEST50441443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:34.713474989 CEST4435044134.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.713665009 CEST4435044134.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.716229916 CEST50441443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:34.716314077 CEST50441443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:34.716334105 CEST4435044134.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.716450930 CEST50441443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:34.779839993 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.779850960 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.782738924 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.783149958 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:34.783159971 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.009341002 CEST4435044418.65.39.112192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.009413004 CEST50444443192.168.2.418.65.39.112
                                                                                  Sep 1, 2024 22:46:35.012942076 CEST50444443192.168.2.418.65.39.112
                                                                                  Sep 1, 2024 22:46:35.012952089 CEST4435044418.65.39.112192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.013143063 CEST4435044418.65.39.112192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.015660048 CEST50444443192.168.2.418.65.39.112
                                                                                  Sep 1, 2024 22:46:35.015763044 CEST50444443192.168.2.418.65.39.112
                                                                                  Sep 1, 2024 22:46:35.015775919 CEST4435044418.65.39.112192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.015908003 CEST50444443192.168.2.418.65.39.112
                                                                                  Sep 1, 2024 22:46:35.024409056 CEST50447443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.024422884 CEST4435044735.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.024652004 CEST50447443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.024739981 CEST50447443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.024749994 CEST4435044735.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.034070969 CEST50448443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.034097910 CEST4435044835.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.034193993 CEST50449443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.034210920 CEST4435044935.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.034296989 CEST50448443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.034318924 CEST50449443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.034380913 CEST50448443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.034393072 CEST4435044835.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.034467936 CEST50449443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.034480095 CEST4435044935.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.138314009 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.141402960 CEST5045080192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.146270037 CEST805045034.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.146456957 CEST5045080192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.146591902 CEST5045080192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.151308060 CEST805045034.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.190598011 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.492772102 CEST4435044735.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.493258953 CEST4435044835.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.494113922 CEST50447443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.494242907 CEST50448443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.497174978 CEST50447443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.497180939 CEST4435044735.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.497355938 CEST4435044935.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.497407913 CEST4435044735.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.497574091 CEST50449443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.499670982 CEST50448443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.499677896 CEST4435044835.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.499927998 CEST4435044835.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.502441883 CEST50449443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.502448082 CEST4435044935.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.502681971 CEST4435044935.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.505608082 CEST50447443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.505728006 CEST4435044735.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.505794048 CEST50447443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.505799055 CEST4435044735.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.506344080 CEST50448443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.506392002 CEST50448443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.506462097 CEST4435044835.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.507119894 CEST50448443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.507471085 CEST50449443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.507546902 CEST50449443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.507585049 CEST4435044935.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.509906054 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.510133982 CEST50449443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.514645100 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.584830999 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.584893942 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:35.586076021 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:35.586081028 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.586318016 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.587274075 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:35.605019093 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.605679989 CEST5045080192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.608345032 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.610780001 CEST805045034.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.610830069 CEST5045080192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.613106966 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.613168955 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.613306046 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.619294882 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.628501892 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.645149946 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:35.712502956 CEST4435044735.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.714402914 CEST50447443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:35.915801048 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.915822029 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.915837049 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.915896893 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:35.915910006 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.916600943 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.916630030 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.917224884 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.917308092 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:35.917566061 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:35.918608904 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:35.918616056 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.918627977 CEST50446443192.168.2.420.114.59.183
                                                                                  Sep 1, 2024 22:46:35.918636084 CEST4435044620.114.59.183192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.043428898 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.098669052 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:36.404203892 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.404253006 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.404387951 CEST49787443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:36.450257063 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.450319052 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.450395107 CEST49788443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:44.371150017 CEST50455443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:44.371176958 CEST4435045535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.372148991 CEST50455443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:44.373662949 CEST50455443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:44.373673916 CEST4435045535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.664567947 CEST50456443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:44.664593935 CEST4435045634.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.665982008 CEST50456443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:44.667350054 CEST50456443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:44.667361021 CEST4435045634.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.691972017 CEST50457443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:44.691992044 CEST4435045734.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.695069075 CEST50457443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:44.696464062 CEST50457443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:44.696484089 CEST4435045734.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.714493990 CEST50458443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:44.714502096 CEST4435045834.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.715477943 CEST50458443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:44.718208075 CEST50458443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:44.718219995 CEST4435045834.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.849206924 CEST4435045535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.849277020 CEST50455443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:44.852478981 CEST50455443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:44.852489948 CEST4435045535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.852689028 CEST4435045535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.855571985 CEST50455443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:44.855645895 CEST50455443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:44.855693102 CEST4435045535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.855788946 CEST50455443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:45.032089949 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.036880016 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.118535995 CEST4435045634.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.118603945 CEST50456443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.123766899 CEST50456443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.123771906 CEST4435045634.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.123898983 CEST50456443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.123902082 CEST4435045634.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.123912096 CEST4435045634.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.123964071 CEST50456443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.124313116 CEST50461443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.124322891 CEST4435046134.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.124392986 CEST50461443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.125745058 CEST50461443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.125754118 CEST4435046134.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.126539946 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.140683889 CEST4435045734.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.140754938 CEST50457443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.145420074 CEST50457443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.145426035 CEST4435045734.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.145555973 CEST50457443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.145709991 CEST4435045734.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.145817041 CEST50457443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.160527945 CEST4435045834.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.168068886 CEST50458443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.170581102 CEST50458443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.170584917 CEST4435045834.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.170778036 CEST4435045834.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.173187017 CEST50458443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.173233986 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.173305035 CEST4435045834.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.173311949 CEST50458443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.173316002 CEST4435045834.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.173372030 CEST50458443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.173614025 CEST50462443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.173620939 CEST4435046234.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.173691034 CEST50462443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.173846960 CEST50462443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.173856020 CEST4435046234.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.228883028 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.230051994 CEST50463443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.230061054 CEST4435046334.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.233668089 CEST50463443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.234276056 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.234996080 CEST50463443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.235003948 CEST4435046334.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.296382904 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.301228046 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.320198059 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.365645885 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.391540051 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.411350012 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.416135073 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.442869902 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.502444029 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.553052902 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.619514942 CEST4435046134.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.619577885 CEST50461443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.625507116 CEST50461443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.625511885 CEST4435046134.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.625580072 CEST50461443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.625624895 CEST4435046134.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.625732899 CEST50461443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.631201982 CEST4435046234.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.636308908 CEST50462443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.639071941 CEST50462443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.639075994 CEST4435046234.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.639303923 CEST4435046234.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.642842054 CEST50462443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.642956972 CEST50462443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.643007994 CEST4435046234.160.144.191192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.643181086 CEST50462443192.168.2.434.160.144.191
                                                                                  Sep 1, 2024 22:46:45.727674007 CEST4435046334.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.733889103 CEST50463443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.737056017 CEST50463443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.737061977 CEST4435046334.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.737140894 CEST50463443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.737186909 CEST4435046334.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.737443924 CEST50464443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.737479925 CEST4435046434.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.737492085 CEST50463443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.737615108 CEST50464443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.738981009 CEST50464443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:45.738995075 CEST4435046434.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.755170107 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.760644913 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.858680010 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:45.910609961 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.955550909 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:45.961639881 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.048868895 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.092554092 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:46.280819893 CEST4435046434.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.285687923 CEST50464443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:46.290926933 CEST50464443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:46.290941000 CEST4435046434.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.291019917 CEST50464443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:46.291078091 CEST4435046434.117.188.166192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.291161060 CEST50464443192.168.2.434.117.188.166
                                                                                  Sep 1, 2024 22:46:46.307616949 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.307657003 CEST4435046535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.308362961 CEST50466443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:46.308378935 CEST4435046634.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.308804035 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.308804989 CEST50466443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:46.308940887 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.308955908 CEST4435046535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.310352087 CEST50466443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:46.310368061 CEST4435046634.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.313575029 CEST50467443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.313601017 CEST4435046734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.313831091 CEST50467443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.315289974 CEST50467443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.315301895 CEST4435046734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.329130888 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:46.333878040 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.338895082 CEST50468443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.338917971 CEST4435046834.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.339580059 CEST50468443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.341191053 CEST50468443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.341204882 CEST4435046834.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.428334951 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.454653025 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:46.459446907 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.478061914 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:46.545454979 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.592925072 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:46.754287958 CEST4435046535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.754359961 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.757102013 CEST4435046734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.760777950 CEST4435046634.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.766431093 CEST50467443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.766571045 CEST50466443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:46.766761065 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.766769886 CEST4435046535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.766978025 CEST4435046535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.773854017 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.773926020 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.773983955 CEST4435046535.244.181.201192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.774698019 CEST50466443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:46.774709940 CEST4435046634.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.774753094 CEST50466443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:46.774851084 CEST4435046634.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.775088072 CEST50467443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.775100946 CEST4435046734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.775139093 CEST50467443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.775264025 CEST4435046734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.776109934 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.776132107 CEST50465443192.168.2.435.244.181.201
                                                                                  Sep 1, 2024 22:46:46.776143074 CEST50466443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:46.776160955 CEST50467443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.785582066 CEST4435046834.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.786833048 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:46.787992001 CEST50468443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.791625023 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.791961908 CEST50468443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.791970968 CEST4435046834.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.792032957 CEST50468443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.792125940 CEST4435046834.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.792330027 CEST50469443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.792349100 CEST4435046934.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.792412043 CEST50468443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.792509079 CEST50469443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.793783903 CEST50469443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:46.793796062 CEST4435046934.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.802062035 CEST50470443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.802084923 CEST4435047034.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.802494049 CEST50470443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.803932905 CEST50470443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:46.803946018 CEST4435047034.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.883948088 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.887595892 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:46.892404079 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.935714960 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:46.978873968 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.020385981 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:47.258342981 CEST4435046934.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.258411884 CEST50469443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:47.263936043 CEST4435047034.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.263998985 CEST50470443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.281641006 CEST50469443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:47.281652927 CEST4435046934.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.281729937 CEST50469443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:47.281802893 CEST4435046934.149.100.209192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.282654047 CEST50470443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.282668114 CEST4435047034.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.282767057 CEST50470443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.282798052 CEST4435047034.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.283473015 CEST50469443192.168.2.434.149.100.209
                                                                                  Sep 1, 2024 22:46:47.283484936 CEST50470443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.285763979 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:47.290527105 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.292984009 CEST50471443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.293025970 CEST4435047134.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.294853926 CEST50471443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.296251059 CEST50471443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.296264887 CEST4435047134.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.313273907 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.313291073 CEST4435047234.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.313990116 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.314250946 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.314263105 CEST4435047234.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.314779997 CEST50473443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.314801931 CEST4435047334.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.314984083 CEST50473443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.315129995 CEST50473443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.315141916 CEST4435047334.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.380292892 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.382564068 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:47.387298107 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.421184063 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:47.474036932 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.520765066 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:47.777262926 CEST4435047134.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.778084040 CEST4435047234.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.781955957 CEST50471443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.781955957 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.785451889 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.785465002 CEST4435047234.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.785660028 CEST4435047234.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.787813902 CEST50471443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.787818909 CEST4435047134.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.787969112 CEST4435047134.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.787998915 CEST50471443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.788005114 CEST4435047134.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.788294077 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.788345098 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.788415909 CEST4435047234.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.790065050 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.790080070 CEST50472443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.790087938 CEST50471443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.790369034 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:47.795727015 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.818110943 CEST4435047334.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.818170071 CEST50473443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.820435047 CEST50473443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.820444107 CEST4435047334.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.820645094 CEST4435047334.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.822303057 CEST50473443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.822367907 CEST50473443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.822438002 CEST4435047334.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.822537899 CEST50473443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:46:47.888310909 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.890918970 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:47.896661043 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.933979034 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:47.994618893 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:48.039026022 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:51.789818048 CEST50474443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:51.789846897 CEST4435047434.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:51.800983906 CEST50474443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:51.802481890 CEST50474443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:51.802500010 CEST4435047434.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.245083094 CEST4435047434.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.245096922 CEST4435047434.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.245215893 CEST50474443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:52.249963999 CEST50474443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:52.249969006 CEST4435047434.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.250052929 CEST50474443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:52.250123024 CEST4435047434.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.250191927 CEST50474443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:46:52.252933025 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:52.257707119 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.347636938 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.351728916 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:52.356563091 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.396837950 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:52.447983980 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.497128963 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:46:52.851650953 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:52.851675034 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:52.998718023 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:52.998728991 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:57.421524048 CEST49787443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:57.421549082 CEST44349787172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:57.421557903 CEST49788443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:57.421574116 CEST44349788172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:47:00.491899967 CEST49771443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:47:00.491919041 CEST44349771162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:47:00.491945028 CEST49772443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:47:00.491967916 CEST44349772162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.030155897 CEST50477443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.030189991 CEST4435047734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.030280113 CEST50478443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.030287027 CEST4435047834.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.030400038 CEST50477443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.030546904 CEST50478443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.030546904 CEST50477443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.030570984 CEST4435047734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.030677080 CEST50478443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.030685902 CEST4435047834.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.033200026 CEST50479443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.033236027 CEST4435047934.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.033307076 CEST50479443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.033412933 CEST50479443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.033425093 CEST4435047934.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.464452028 CEST4435047734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.464543104 CEST50477443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.467469931 CEST50477443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.467478037 CEST4435047734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.467683077 CEST4435047734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.469728947 CEST50477443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.469837904 CEST50477443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.469863892 CEST4435047734.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.470208883 CEST50477443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.473113060 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:01.477900028 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.482496977 CEST4435047834.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.482564926 CEST50478443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.485234976 CEST50478443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.485239983 CEST4435047834.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.485436916 CEST4435047834.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.487535000 CEST50478443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.487644911 CEST50478443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.487663984 CEST4435047834.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.487780094 CEST50478443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.495831966 CEST4435047934.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.500500917 CEST4435047934.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.510883093 CEST50479443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.513653994 CEST50479443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.513660908 CEST4435047934.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.513895035 CEST4435047934.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.515816927 CEST50479443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.515904903 CEST50479443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.516011953 CEST4435047934.120.208.123192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.516959906 CEST50479443192.168.2.434.120.208.123
                                                                                  Sep 1, 2024 22:47:01.569416046 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.590693951 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:01.595731020 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.624991894 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:01.681268930 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:01.725197077 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:02.902616024 CEST50480443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:02.902650118 CEST4435048034.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:02.902864933 CEST50480443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:02.904369116 CEST50480443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:02.904381037 CEST4435048034.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.338411093 CEST4435048034.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.338511944 CEST50480443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:03.342576981 CEST50480443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:03.342585087 CEST4435048034.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.342621088 CEST50480443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:03.342720985 CEST4435048034.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.342787027 CEST50480443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:03.345045090 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:03.349816084 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.440088987 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.442840099 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:03.447844028 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.488666058 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:03.533561945 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.578744888 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:06.165060043 CEST4972380192.168.2.42.19.126.163
                                                                                  Sep 1, 2024 22:47:06.165158987 CEST4972480192.168.2.42.19.126.163
                                                                                  Sep 1, 2024 22:47:06.170830965 CEST80497232.19.126.163192.168.2.4
                                                                                  Sep 1, 2024 22:47:06.170842886 CEST80497242.19.126.163192.168.2.4
                                                                                  Sep 1, 2024 22:47:06.170923948 CEST4972380192.168.2.42.19.126.163
                                                                                  Sep 1, 2024 22:47:06.170938969 CEST4972480192.168.2.42.19.126.163
                                                                                  Sep 1, 2024 22:47:13.453918934 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:13.458786011 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:13.536521912 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:13.541594028 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:23.463673115 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:23.468580961 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:23.558985949 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:23.564027071 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:23.972955942 CEST50481443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:23.972982883 CEST4435048134.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:23.973166943 CEST50481443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:23.974561930 CEST50481443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:23.974574089 CEST4435048134.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:24.478682995 CEST4435048134.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:24.478739023 CEST50481443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:24.483082056 CEST50481443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:24.483088017 CEST4435048134.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:24.483182907 CEST50481443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:24.483216047 CEST4435048134.107.243.93192.168.2.4
                                                                                  Sep 1, 2024 22:47:24.483444929 CEST50481443192.168.2.434.107.243.93
                                                                                  Sep 1, 2024 22:47:24.486392021 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:24.491269112 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:24.581990004 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:24.588772058 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:24.593877077 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:24.640165091 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:24.679963112 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:24.724937916 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:34.588766098 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:34.593796015 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:34.689008951 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:34.694691896 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:37.856125116 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:47:37.856148005 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:47:38.010837078 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:47:38.010854959 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:47:40.813200951 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:40.817984104 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:40.908248901 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:40.910854101 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:40.915616989 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:40.956868887 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:41.001401901 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:41.056946993 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:42.146024942 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:47:42.146055937 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:47:42.146107912 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:47:42.146120071 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:47:42.146401882 CEST44349777142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:47:42.146431923 CEST44349778142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:47:42.146491051 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:47:42.146508932 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:47:42.146575928 CEST49777443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:47:42.146702051 CEST49778443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:47:50.909796953 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:50.914616108 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:47:51.002938986 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:47:51.007987022 CEST805045234.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:48:00.926258087 CEST5044580192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:48:00.931121111 CEST805044534.107.221.82192.168.2.4
                                                                                  Sep 1, 2024 22:48:01.023040056 CEST5045280192.168.2.434.107.221.82
                                                                                  Sep 1, 2024 22:48:01.034388065 CEST805045234.107.221.82192.168.2.4

                                                                                  UDP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  Sep 1, 2024 22:45:59.688699007 CEST53531581.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:00.486558914 CEST5750553192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:00.486711979 CEST6217953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:00.759831905 CEST6051753192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:00.760108948 CEST5347553192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:00.768285036 CEST53534751.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:00.768433094 CEST53605171.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:01.973088026 CEST53639341.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:02.211594105 CEST53586181.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:02.654295921 CEST6030153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:02.663975000 CEST5024553192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:02.671235085 CEST53502451.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:02.671859026 CEST6006153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:02.679424047 CEST53600611.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:02.877317905 CEST5907953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:02.884989977 CEST53590791.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:02.888505936 CEST5059653192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:02.896159887 CEST53505961.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.131539106 CEST5239353192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.138029099 CEST53523931.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.146450996 CEST6390753192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.154213905 CEST53639071.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.157005072 CEST5289153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.507149935 CEST6295553192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.507601023 CEST5688053192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.507910967 CEST6380053192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.508163929 CEST6509353192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.526118994 CEST53629551.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.526191950 CEST53638001.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.526225090 CEST53568801.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.526235104 CEST53650931.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.633268118 CEST5255853192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.633543968 CEST5172653192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:03.640136003 CEST53525581.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:03.640780926 CEST53517261.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.522332907 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.840051889 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.965384007 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.965401888 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.965415001 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.965468884 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.965481997 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:05.966414928 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.967535019 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.972385883 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.972489119 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.972795010 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:05.972903967 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.063026905 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.063080072 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.063091040 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.063101053 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.063555956 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.063847065 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.065249920 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.066426039 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.067040920 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.067794085 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.153862000 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.158025026 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.158138037 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.192897081 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.251403093 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.253267050 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.253369093 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.256340981 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.704372883 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.704500914 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.798839092 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.799532890 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.799645901 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:06.835239887 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:06.925100088 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.233886003 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.379272938 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.379290104 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.385040045 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.385060072 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.385072947 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.385128021 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.385293961 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.385361910 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.389789104 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.390927076 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.391108990 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.391494989 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.391510010 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.391663074 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.494688988 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.494801998 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.495495081 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.495945930 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.497033119 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.497214079 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.510130882 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.510678053 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.511934996 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.515286922 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:07.619961023 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:07.990160942 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:07.990569115 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:08.082618952 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.083482027 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.083705902 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:08.084081888 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:15.316987991 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:15.317028999 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:15.456258059 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:15.485260010 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:15.485515118 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:15.485615015 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:15.512393951 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:15.726418972 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:15.726878881 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:15.728840113 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:15.832413912 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:17.750674009 CEST138138192.168.2.4192.168.2.255
                                                                                  Sep 1, 2024 22:46:19.149568081 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:19.149724007 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:19.243598938 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:19.245148897 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:19.265804052 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:19.266098976 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:21.049611092 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:21.050020933 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:21.051167965 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.142122984 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.143738031 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.144413948 CEST44357341162.159.61.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.151830912 CEST57341443192.168.2.4162.159.61.3
                                                                                  Sep 1, 2024 22:46:21.353316069 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.482877016 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.483119011 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.483182907 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.483196020 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.483234882 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.488737106 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.488809109 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.490601063 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.490931034 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.491044998 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.491265059 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.491384029 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.582998037 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.583462954 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.583785057 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.583996058 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.584006071 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.584295034 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.585138083 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.586011887 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.587497950 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.587919950 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:21.676127911 CEST44352946172.64.41.3192.168.2.4
                                                                                  Sep 1, 2024 22:46:21.720455885 CEST52946443192.168.2.4172.64.41.3
                                                                                  Sep 1, 2024 22:46:28.633284092 CEST5360510162.159.36.2192.168.2.4
                                                                                  Sep 1, 2024 22:46:29.121670961 CEST5717353192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:29.128962040 CEST53571731.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.178316116 CEST5665153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.186240911 CEST53566511.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.187766075 CEST5329253192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.189065933 CEST6253353192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.200602055 CEST53532921.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.200613022 CEST53625331.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.201251030 CEST6269153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.201251030 CEST6401953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.209894896 CEST53626911.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.210035086 CEST53640191.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.321474075 CEST6222553192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.331043959 CEST53622251.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.332103968 CEST5033253192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.350184917 CEST53503321.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.350708008 CEST6217053192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.357534885 CEST53621701.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.673711061 CEST5226153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.684674978 CEST6198653192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.691941023 CEST53619861.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:34.692502975 CEST5007653192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:34.699172974 CEST53500761.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.139091015 CEST5464553192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:35.139271021 CEST5882153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:35.145781994 CEST53546451.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:35.146115065 CEST53588211.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.241451979 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:36.340106010 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.353986979 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.354231119 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:36.360939026 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:36.394584894 CEST58328443192.168.2.4142.250.80.46
                                                                                  Sep 1, 2024 22:46:36.485372066 CEST44358328142.250.80.46192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.376805067 CEST6019153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.385772943 CEST53601911.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.654345036 CEST5603253192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.661180019 CEST53560321.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.665643930 CEST6150453192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.674391985 CEST6237853192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.674397945 CEST53615041.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.674894094 CEST5137953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.681396008 CEST53623781.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.681587934 CEST53513791.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.695003986 CEST5705153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.701761007 CEST6448053192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.703247070 CEST53570511.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.704637051 CEST5866953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.711208105 CEST53644801.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.714868069 CEST6467853192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.717499018 CEST53586691.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.722739935 CEST53646781.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.726178885 CEST6467653192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.735177994 CEST53646761.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:44.862890959 CEST5338453192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:44.905980110 CEST53626031.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.047271013 CEST5751153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:46.055182934 CEST53575111.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.057177067 CEST6237053192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:46.064815998 CEST53623701.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.076164007 CEST5477553192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:46.082880020 CEST53547751.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.313767910 CEST5192653192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:46.321367025 CEST53519261.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:46.325475931 CEST6404653192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:46.333808899 CEST53640461.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.870224953 CEST5530553192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:47.877624989 CEST53553051.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.878285885 CEST6493153192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:47.886673927 CEST53649311.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:47.887190104 CEST6118953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:47.896176100 CEST53611891.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:46:51.790492058 CEST6332253192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:46:51.797202110 CEST53633221.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:47:00.492501020 CEST6171853192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:47:01.045341015 CEST6104653192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:47:01.052081108 CEST53610461.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:47:02.902082920 CEST5274953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:47:02.908922911 CEST53527491.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:47:02.913393974 CEST5706953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:47:02.921155930 CEST53570691.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:47:03.345307112 CEST5028953192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:47:23.963674068 CEST6500453192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:47:23.972064018 CEST53650041.1.1.1192.168.2.4
                                                                                  Sep 1, 2024 22:47:23.973109007 CEST5443453192.168.2.41.1.1.1
                                                                                  Sep 1, 2024 22:47:23.981606007 CEST53544341.1.1.1192.168.2.4

                                                                                  DNS Queries

                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                  Sep 1, 2024 22:46:00.486558914 CEST192.168.2.41.1.1.10xcc3aStandard query (0)bzib.nelreports.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:00.486711979 CEST192.168.2.41.1.1.10x31adStandard query (0)bzib.nelreports.net65IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:00.759831905 CEST192.168.2.41.1.1.10x5cf5Standard query (0)clients2.googleusercontent.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:00.760108948 CEST192.168.2.41.1.1.10x4e1aStandard query (0)clients2.googleusercontent.com65IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.654295921 CEST192.168.2.41.1.1.10x9d3bStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.663975000 CEST192.168.2.41.1.1.10xbe18Standard query (0)prod.detectportal.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.671859026 CEST192.168.2.41.1.1.10x6120Standard query (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.877317905 CEST192.168.2.41.1.1.10x9804Standard query (0)prod.classify-client.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.888505936 CEST192.168.2.41.1.1.10x426cStandard query (0)prod.classify-client.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.131539106 CEST192.168.2.41.1.1.10x587Standard query (0)example.orgA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.146450996 CEST192.168.2.41.1.1.10xb203Standard query (0)ipv4only.arpaA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.157005072 CEST192.168.2.41.1.1.10xeb63Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.507149935 CEST192.168.2.41.1.1.10xb17cStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.507601023 CEST192.168.2.41.1.1.10x964bStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.507910967 CEST192.168.2.41.1.1.10xf2b0Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.508163929 CEST192.168.2.41.1.1.10x805dStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.633268118 CEST192.168.2.41.1.1.10x16c9Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.633543968 CEST192.168.2.41.1.1.10xb393Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:29.121670961 CEST192.168.2.41.1.1.10xd71cStandard query (0)206.23.85.13.in-addr.arpaPTR (Pointer record)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.178316116 CEST192.168.2.41.1.1.10x1851Standard query (0)firefox.settings.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.187766075 CEST192.168.2.41.1.1.10xe695Standard query (0)prod.remote-settings.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.189065933 CEST192.168.2.41.1.1.10x2320Standard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.201251030 CEST192.168.2.41.1.1.10x439eStandard query (0)prod.remote-settings.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.201251030 CEST192.168.2.41.1.1.10x9ee6Standard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.321474075 CEST192.168.2.41.1.1.10xf463Standard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.332103968 CEST192.168.2.41.1.1.10x333aStandard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.350708008 CEST192.168.2.41.1.1.10x7f16Standard query (0)services.addons.mozilla.org28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.673711061 CEST192.168.2.41.1.1.10xc40eStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.684674978 CEST192.168.2.41.1.1.10x5656Standard query (0)prod.detectportal.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.692502975 CEST192.168.2.41.1.1.10x3dacStandard query (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.139091015 CEST192.168.2.41.1.1.10xa006Standard query (0)example.orgA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.139271021 CEST192.168.2.41.1.1.10x1f8bStandard query (0)ipv4only.arpaA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.376805067 CEST192.168.2.41.1.1.10x268Standard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.654345036 CEST192.168.2.41.1.1.10x1ceStandard query (0)contile.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.665643930 CEST192.168.2.41.1.1.10xcc0cStandard query (0)contile.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.674391985 CEST192.168.2.41.1.1.10xe146Standard query (0)spocs.getpocket.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.674894094 CEST192.168.2.41.1.1.10xeec5Standard query (0)contile.services.mozilla.com28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.695003986 CEST192.168.2.41.1.1.10xe958Standard query (0)prod.ads.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.701761007 CEST192.168.2.41.1.1.10x55f4Standard query (0)content-signature-2.cdn.mozilla.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.704637051 CEST192.168.2.41.1.1.10x3839Standard query (0)prod.ads.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.714868069 CEST192.168.2.41.1.1.10x8397Standard query (0)prod.content-signature-chains.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.726178885 CEST192.168.2.41.1.1.10xbfd5Standard query (0)prod.content-signature-chains.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.862890959 CEST192.168.2.41.1.1.10x6138Standard query (0)shavar.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.047271013 CEST192.168.2.41.1.1.10x9725Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.057177067 CEST192.168.2.41.1.1.10xa59cStandard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.076164007 CEST192.168.2.41.1.1.10xf292Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.313767910 CEST192.168.2.41.1.1.10xd55eStandard query (0)telemetry-incoming.r53-2.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.325475931 CEST192.168.2.41.1.1.10xf7c2Standard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:47.870224953 CEST192.168.2.41.1.1.10xc267Standard query (0)support.mozilla.orgA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:47.878285885 CEST192.168.2.41.1.1.10xb4d9Standard query (0)us-west1.prod.sumo.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:47.887190104 CEST192.168.2.41.1.1.10x574cStandard query (0)us-west1.prod.sumo.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:51.790492058 CEST192.168.2.41.1.1.10x90e3Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:00.492501020 CEST192.168.2.41.1.1.10x8dadStandard query (0)bzib.nelreports.netA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:01.045341015 CEST192.168.2.41.1.1.10xc000Standard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:02.902082920 CEST192.168.2.41.1.1.10x926cStandard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:02.913393974 CEST192.168.2.41.1.1.10xc17dStandard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:03.345307112 CEST192.168.2.41.1.1.10x8fa5Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:23.963674068 CEST192.168.2.41.1.1.10xd025Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:23.973109007 CEST192.168.2.41.1.1.10xa8b1Standard query (0)push.services.mozilla.com28IN (0x0001)false

                                                                                  DNS Answers

                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                  Sep 1, 2024 22:46:00.493947029 CEST1.1.1.1192.168.2.40xcc3aNo error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:00.494211912 CEST1.1.1.1192.168.2.40x31adNo error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:00.768285036 CEST1.1.1.1192.168.2.40x4e1aNo error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:00.768433094 CEST1.1.1.1192.168.2.40x5cf5No error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:00.768433094 CEST1.1.1.1192.168.2.40x5cf5No error (0)googlehosted.l.googleusercontent.com142.250.185.161A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.084333897 CEST1.1.1.1192.168.2.40x1301No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.085774899 CEST1.1.1.1192.168.2.40xf016No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.085774899 CEST1.1.1.1192.168.2.40xf016No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.661160946 CEST1.1.1.1192.168.2.40x9d3bNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.661160946 CEST1.1.1.1192.168.2.40x9d3bNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.671235085 CEST1.1.1.1192.168.2.40xbe18No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.679424047 CEST1.1.1.1192.168.2.40x6120No error (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.875010014 CEST1.1.1.1192.168.2.40x8244No error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:02.884989977 CEST1.1.1.1192.168.2.40x9804No error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.095359087 CEST1.1.1.1192.168.2.40x1673No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.095359087 CEST1.1.1.1192.168.2.40x1673No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.095567942 CEST1.1.1.1192.168.2.40x4880No error (0)wildcard.sf.tlu.dl.delivery.mp.microsoft.com.cdn.dnsv1.commicrosoft-sf.ovslegodl.sched.ovscdns.comCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.138029099 CEST1.1.1.1192.168.2.40x587No error (0)example.org93.184.215.14A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.154213905 CEST1.1.1.1192.168.2.40xb203No error (0)ipv4only.arpa192.0.0.170A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.154213905 CEST1.1.1.1192.168.2.40xb203No error (0)ipv4only.arpa192.0.0.171A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.163729906 CEST1.1.1.1192.168.2.40xeb63No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.163729906 CEST1.1.1.1192.168.2.40xeb63No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.526118994 CEST1.1.1.1192.168.2.40xb17cNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.526118994 CEST1.1.1.1192.168.2.40xb17cNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.526181936 CEST1.1.1.1192.168.2.40x37c6No error (0)shed.dual-low.s-part-0029.t-0009.t-msedge.nets-part-0029.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.526181936 CEST1.1.1.1192.168.2.40x37c6No error (0)s-part-0029.t-0009.t-msedge.net13.107.246.57A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.526191950 CEST1.1.1.1192.168.2.40xf2b0No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.526191950 CEST1.1.1.1192.168.2.40xf2b0No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.526225090 CEST1.1.1.1192.168.2.40x964bNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.526235104 CEST1.1.1.1192.168.2.40x805dNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.640136003 CEST1.1.1.1192.168.2.40x16c9No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.640136003 CEST1.1.1.1192.168.2.40x16c9No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:03.640780926 CEST1.1.1.1192.168.2.40xb393No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:05.153444052 CEST1.1.1.1192.168.2.40x7a36No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:05.153444052 CEST1.1.1.1192.168.2.40x7a36No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:06.169902086 CEST1.1.1.1192.168.2.40x7a36No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:06.169902086 CEST1.1.1.1192.168.2.40x7a36No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:07.178289890 CEST1.1.1.1192.168.2.40x7a36No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:07.178289890 CEST1.1.1.1192.168.2.40x7a36No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:09.184026957 CEST1.1.1.1192.168.2.40x7a36No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:09.184026957 CEST1.1.1.1192.168.2.40x7a36No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:13.184149027 CEST1.1.1.1192.168.2.40x7a36No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:13.184149027 CEST1.1.1.1192.168.2.40x7a36No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:29.128962040 CEST1.1.1.1192.168.2.40xd71cName error (3)206.23.85.13.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.186240911 CEST1.1.1.1192.168.2.40x1851No error (0)firefox.settings.services.mozilla.comprod.remote-settings.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.186240911 CEST1.1.1.1192.168.2.40x1851No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.188205957 CEST1.1.1.1192.168.2.40xa013No error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.188205957 CEST1.1.1.1192.168.2.40xa013No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.200602055 CEST1.1.1.1192.168.2.40xe695No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.200613022 CEST1.1.1.1192.168.2.40x2320No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.331043959 CEST1.1.1.1192.168.2.40xf463No error (0)services.addons.mozilla.org18.65.39.112A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.331043959 CEST1.1.1.1192.168.2.40xf463No error (0)services.addons.mozilla.org18.65.39.4A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.331043959 CEST1.1.1.1192.168.2.40xf463No error (0)services.addons.mozilla.org18.65.39.85A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.331043959 CEST1.1.1.1192.168.2.40xf463No error (0)services.addons.mozilla.org18.65.39.31A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.350184917 CEST1.1.1.1192.168.2.40x333aNo error (0)services.addons.mozilla.org18.65.39.112A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.350184917 CEST1.1.1.1192.168.2.40x333aNo error (0)services.addons.mozilla.org18.65.39.4A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.350184917 CEST1.1.1.1192.168.2.40x333aNo error (0)services.addons.mozilla.org18.65.39.85A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.350184917 CEST1.1.1.1192.168.2.40x333aNo error (0)services.addons.mozilla.org18.65.39.31A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.682729959 CEST1.1.1.1192.168.2.40xc40eNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.682729959 CEST1.1.1.1192.168.2.40xc40eNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.691941023 CEST1.1.1.1192.168.2.40x5656No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:34.699172974 CEST1.1.1.1192.168.2.40x3dacNo error (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.033349991 CEST1.1.1.1192.168.2.40xd700No error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.033349991 CEST1.1.1.1192.168.2.40xd700No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.145781994 CEST1.1.1.1192.168.2.40xa006No error (0)example.org93.184.215.14A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.146115065 CEST1.1.1.1192.168.2.40x1f8bNo error (0)ipv4only.arpa192.0.0.170A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.146115065 CEST1.1.1.1192.168.2.40x1f8bNo error (0)ipv4only.arpa192.0.0.171A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.521749973 CEST1.1.1.1192.168.2.40x52bNo error (0)a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.coma17.rackcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:35.521749973 CEST1.1.1.1192.168.2.40x52bNo error (0)a17.rackcdn.coma17.rackcdn.com.mdc.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.661180019 CEST1.1.1.1192.168.2.40x1ceNo error (0)contile.services.mozilla.com34.117.188.166A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.674397945 CEST1.1.1.1192.168.2.40xcc0cNo error (0)contile.services.mozilla.com34.117.188.166A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.681396008 CEST1.1.1.1192.168.2.40xe146No error (0)spocs.getpocket.comprod.ads.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.681396008 CEST1.1.1.1192.168.2.40xe146No error (0)prod.ads.prod.webservices.mozgcp.net34.117.188.166A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.703247070 CEST1.1.1.1192.168.2.40xe958No error (0)prod.ads.prod.webservices.mozgcp.net34.117.188.166A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.711208105 CEST1.1.1.1192.168.2.40x55f4No error (0)content-signature-2.cdn.mozilla.netcontent-signature-chains.prod.autograph.services.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.711208105 CEST1.1.1.1192.168.2.40x55f4No error (0)content-signature-chains.prod.autograph.services.mozaws.netprod.content-signature-chains.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.711208105 CEST1.1.1.1192.168.2.40x55f4No error (0)prod.content-signature-chains.prod.webservices.mozgcp.net34.160.144.191A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.722739935 CEST1.1.1.1192.168.2.40x8397No error (0)prod.content-signature-chains.prod.webservices.mozgcp.net34.160.144.191A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.735177994 CEST1.1.1.1192.168.2.40xbfd5No error (0)prod.content-signature-chains.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:44.872852087 CEST1.1.1.1192.168.2.40x6138No error (0)shavar.services.mozilla.comshavar.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.055182934 CEST1.1.1.1192.168.2.40x9725No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.064815998 CEST1.1.1.1192.168.2.40xa59cNo error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.312844992 CEST1.1.1.1192.168.2.40x57aaNo error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.321367025 CEST1.1.1.1192.168.2.40xd55eNo error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:46.801202059 CEST1.1.1.1192.168.2.40x5489No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:47.877624989 CEST1.1.1.1192.168.2.40xc267No error (0)support.mozilla.orgprod.sumo.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:47.877624989 CEST1.1.1.1192.168.2.40xc267No error (0)prod.sumo.prod.webservices.mozgcp.netus-west1.prod.sumo.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:47.877624989 CEST1.1.1.1192.168.2.40xc267No error (0)us-west1.prod.sumo.prod.webservices.mozgcp.net34.149.128.2A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:46:47.886673927 CEST1.1.1.1192.168.2.40xb4d9No error (0)us-west1.prod.sumo.prod.webservices.mozgcp.net34.149.128.2A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:00.500547886 CEST1.1.1.1192.168.2.40x8dadNo error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:01.037281990 CEST1.1.1.1192.168.2.40x8789No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:02.908922911 CEST1.1.1.1192.168.2.40x926cNo error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:03.351950884 CEST1.1.1.1192.168.2.40x8fa5No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:03.351950884 CEST1.1.1.1192.168.2.40x8fa5No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                  Sep 1, 2024 22:47:23.972064018 CEST1.1.1.1192.168.2.40xd025No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false

                                                                                  HTTP Request Dependency Graph

                                                                                  • clients2.googleusercontent.com
                                                                                  • chrome.cloudflare-dns.com
                                                                                  • edgeassetservice.azureedge.net
                                                                                  • fs.microsoft.com
                                                                                  • https:
                                                                                    • www.google.com
                                                                                  • www.googleapis.com
                                                                                  • slscr.update.microsoft.com
                                                                                  • msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
                                                                                  • fe3cr.delivery.mp.microsoft.com
                                                                                  • detectportal.firefox.com

                                                                                  HTTP Packets

                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  0192.168.2.44975534.107.221.82807584C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Sep 1, 2024 22:46:02.669707060 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:03.100228071 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 00:21:55 GMT
                                                                                  Age: 73448
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:04.579483032 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:04.672112942 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 00:21:55 GMT
                                                                                  Age: 73449
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:14.686614990 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:46:24.692656994 CEST6OUTData Raw: 00
                                                                                  Data Ascii:


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  1192.168.2.44975734.107.221.82807584C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Sep 1, 2024 22:46:03.288034916 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:03.753206968 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66645
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:04.686434984 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:04.786345959 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66646
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:14.809063911 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:46:24.813477039 CEST6OUTData Raw: 00
                                                                                  Data Ascii:


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  2192.168.2.45044534.107.221.82807584C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Sep 1, 2024 22:46:34.692903042 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:35.138314009 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68091
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:35.509906054 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:35.605019093 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68091
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:45.032089949 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:45.126539946 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68101
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:45.296382904 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:45.391540051 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68101
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:45.755170107 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:45.858680010 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68101
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:46.329130888 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:46.428334951 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68102
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:46.786833048 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:46.883948088 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68102
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:47.285763979 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:47.380292892 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68103
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:47.790369034 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:47.888310909 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68103
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:46:52.252933025 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:46:52.347636938 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68108
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:47:01.473113060 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:47:01.569416046 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68117
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:47:03.345045090 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:47:03.440088987 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68119
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:47:13.453918934 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:47:23.463673115 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:47:24.486392021 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:47:24.581990004 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68140
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:47:34.588766098 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:47:40.813200951 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Connection: keep-alive
                                                                                  Sep 1, 2024 22:47:40.908248901 CEST298INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 90
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 01:51:44 GMT
                                                                                  Age: 68156
                                                                                  Content-Type: text/html
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                  Sep 1, 2024 22:47:50.909796953 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:48:00.926258087 CEST6OUTData Raw: 00
                                                                                  Data Ascii:


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  3192.168.2.45045034.107.221.82807584C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Sep 1, 2024 22:46:35.146591902 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  4192.168.2.45045234.107.221.82807584C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Sep 1, 2024 22:46:35.613306046 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:36.043428898 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66678
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:45.228883028 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:45.320198059 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66687
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:45.411350012 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:45.502444029 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66687
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:45.955550909 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:46.048868895 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66688
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:46.454653025 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:46.545454979 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66688
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:46.887595892 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:46.978873968 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66688
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:47.382564068 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:47.474036932 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66689
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:47.890918970 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:47.994618893 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66689
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:46:52.351728916 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:46:52.447983980 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66694
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:47:01.590693951 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:47:01.681268930 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66703
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:47:03.442840099 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:47:03.533561945 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66705
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:47:13.536521912 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:47:23.558985949 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:47:24.588772058 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:47:24.679963112 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66726
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:47:34.689008951 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:47:40.910854101 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                  Host: detectportal.firefox.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                  Accept: */*
                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  Connection: keep-alive
                                                                                  Pragma: no-cache
                                                                                  Cache-Control: no-cache
                                                                                  Sep 1, 2024 22:47:41.001401901 CEST216INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Content-Length: 8
                                                                                  Via: 1.1 google
                                                                                  Date: Sun, 01 Sep 2024 02:15:18 GMT
                                                                                  Age: 66742
                                                                                  Content-Type: text/plain
                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                  Data Ascii: success
                                                                                  Sep 1, 2024 22:47:51.002938986 CEST6OUTData Raw: 00
                                                                                  Data Ascii:
                                                                                  Sep 1, 2024 22:48:01.023040056 CEST6OUTData Raw: 00
                                                                                  Data Ascii:


                                                                                  HTTPS Proxied Packets

                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  0192.168.2.449743142.250.185.1614437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:01 UTC594OUTGET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1
                                                                                  Host: clients2.googleusercontent.com
                                                                                  Connection: keep-alive
                                                                                  Sec-Fetch-Site: none
                                                                                  Sec-Fetch-Mode: no-cors
                                                                                  Sec-Fetch-Dest: empty
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:01 UTC565INHTTP/1.1 200 OK
                                                                                  Accept-Ranges: bytes
                                                                                  Content-Length: 135751
                                                                                  X-GUploader-UploadID: AD-8ljvMYnhlVkrc1EfMJDl1r0TMYFs9OYJ7-Z4zYvQiUj3XnnoMp-t8ZQkY-WhApprCKsHvzWg
                                                                                  X-Goog-Hash: crc32c=IDdmTg==
                                                                                  Server: UploadServer
                                                                                  Date: Sun, 01 Sep 2024 19:26:09 GMT
                                                                                  Expires: Mon, 01 Sep 2025 19:26:09 GMT
                                                                                  Cache-Control: public, max-age=31536000
                                                                                  Age: 4792
                                                                                  Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT
                                                                                  ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016
                                                                                  Content-Type: application/x-chrome-extension
                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                  Connection: close
                                                                                  2024-09-01 20:46:01 UTC825INData Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08
                                                                                  Data Ascii: Cr240"0*H0^1"wgt2JG1)X4=&?[j,Lzjue[Iq*Ba/XPhL2%3_oH)'=e?j3UH|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 17
                                                                                  Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.|ws+LT>&&Pjanss9ga:SY>J:9
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 a2
                                                                                  Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z|pQ"k<`ZT|uKC1Yg4ewWe5
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c 0d
                                                                                  Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b|wt7nvtD<C}|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](|
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe e3
                                                                                  Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 49
                                                                                  Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,pI
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 61
                                                                                  Data Ascii: =%2n$hgffa,_@uYk|9.Y1+x8aBP|*].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=e*ZkLS65mj}0"$MmDhPa
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 c3
                                                                                  Data Ascii: nh"|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF|V1lvgf&3]1g>Lc(s.u,2
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 90
                                                                                  Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
                                                                                  2024-09-01 20:46:01 UTC1390INData Raw: 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f 97
                                                                                  Data Ascii: N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  1192.168.2.449758162.159.61.34437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:04 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                  Host: chrome.cloudflare-dns.com
                                                                                  Connection: keep-alive
                                                                                  Content-Length: 128
                                                                                  Accept: application/dns-message
                                                                                  Accept-Language: *
                                                                                  User-Agent: Chrome
                                                                                  Accept-Encoding: identity
                                                                                  Content-Type: application/dns-message
                                                                                  2024-09-01 20:46:04 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                  Data Ascii: wwwgstaticcom)TP
                                                                                  2024-09-01 20:46:04 UTC247INHTTP/1.1 200 OK
                                                                                  Server: cloudflare
                                                                                  Date: Sun, 01 Sep 2024 20:46:04 GMT
                                                                                  Content-Type: application/dns-message
                                                                                  Connection: close
                                                                                  Access-Control-Allow-Origin: *
                                                                                  Content-Length: 468
                                                                                  CF-RAY: 8bc81b8b8e5843bb-EWR
                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                  2024-09-01 20:46:04 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                  Data Ascii: wwwgstaticcomP#)


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  2192.168.2.449762172.64.41.34437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:04 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                  Host: chrome.cloudflare-dns.com
                                                                                  Connection: keep-alive
                                                                                  Content-Length: 128
                                                                                  Accept: application/dns-message
                                                                                  Accept-Language: *
                                                                                  User-Agent: Chrome
                                                                                  Accept-Encoding: identity
                                                                                  Content-Type: application/dns-message
                                                                                  2024-09-01 20:46:04 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                  Data Ascii: wwwgstaticcom)TP
                                                                                  2024-09-01 20:46:04 UTC247INHTTP/1.1 200 OK
                                                                                  Server: cloudflare
                                                                                  Date: Sun, 01 Sep 2024 20:46:04 GMT
                                                                                  Content-Type: application/dns-message
                                                                                  Connection: close
                                                                                  Access-Control-Allow-Origin: *
                                                                                  Content-Length: 468
                                                                                  CF-RAY: 8bc81b8b9d3a4333-EWR
                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                  2024-09-01 20:46:04 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 01 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                  Data Ascii: wwwgstaticcomP#)


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  3192.168.2.449764162.159.61.34437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:04 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                  Host: chrome.cloudflare-dns.com
                                                                                  Connection: keep-alive
                                                                                  Content-Length: 128
                                                                                  Accept: application/dns-message
                                                                                  Accept-Language: *
                                                                                  User-Agent: Chrome
                                                                                  Accept-Encoding: identity
                                                                                  Content-Type: application/dns-message
                                                                                  2024-09-01 20:46:04 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                  Data Ascii: wwwgstaticcom)TP
                                                                                  2024-09-01 20:46:04 UTC247INHTTP/1.1 200 OK
                                                                                  Server: cloudflare
                                                                                  Date: Sun, 01 Sep 2024 20:46:04 GMT
                                                                                  Content-Type: application/dns-message
                                                                                  Connection: close
                                                                                  Access-Control-Allow-Origin: *
                                                                                  Content-Length: 468
                                                                                  CF-RAY: 8bc81b8c3dbe438d-EWR
                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                  2024-09-01 20:46:04 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 04 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                  Data Ascii: wwwgstaticcom()


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  4192.168.2.44975913.107.246.574437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:04 UTC711OUTGET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1
                                                                                  Host: edgeassetservice.azureedge.net
                                                                                  Connection: keep-alive
                                                                                  Edge-Asset-Group: EntityExtractionDomainsConfig
                                                                                  Sec-Mesh-Client-Edge-Version: 117.0.2045.47
                                                                                  Sec-Mesh-Client-Edge-Channel: stable
                                                                                  Sec-Mesh-Client-OS: Windows
                                                                                  Sec-Mesh-Client-OS-Version: 10.0.19045
                                                                                  Sec-Mesh-Client-Arch: x86_64
                                                                                  Sec-Mesh-Client-WebView: 0
                                                                                  Sec-Fetch-Site: none
                                                                                  Sec-Fetch-Mode: no-cors
                                                                                  Sec-Fetch-Dest: empty
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:04 UTC583INHTTP/1.1 200 OK
                                                                                  Date: Sun, 01 Sep 2024 20:46:04 GMT
                                                                                  Content-Type: application/octet-stream
                                                                                  Content-Length: 70207
                                                                                  Connection: close
                                                                                  Content-Encoding: gzip
                                                                                  Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT
                                                                                  ETag: 0x8DCB31E67C22927
                                                                                  x-ms-request-id: 66f87118-601e-001a-2116-f94768000000
                                                                                  x-ms-version: 2009-09-19
                                                                                  x-ms-lease-status: unlocked
                                                                                  x-ms-blob-type: BlockBlob
                                                                                  x-azure-ref: 20240901T204604Z-16579567576phhfj0h0z9mnmag00000006vg000000001znh
                                                                                  Cache-Control: public, max-age=604800
                                                                                  x-fd-int-roxy-purgeid: 69316365
                                                                                  X-Cache: TCP_HIT
                                                                                  X-Cache-Info: L1_T2
                                                                                  Accept-Ranges: bytes
                                                                                  2024-09-01 20:46:04 UTC15801INData Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7
                                                                                  Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31
                                                                                  Data Ascii: JEq*b,0Rte*|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;|a``|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63
                                                                                  Data Ascii: /M5?Rg|M kt|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX*$Nkct&iZ%b8Zoj@ u2OgA1DG3*5d*lg|9GV>OVzVMPA76.|c
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81
                                                                                  Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
                                                                                  2024-09-01 20:46:04 UTC5254INData Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83
                                                                                  Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  5192.168.2.44976013.107.246.574437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:04 UTC470OUTGET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1
                                                                                  Host: edgeassetservice.azureedge.net
                                                                                  Connection: keep-alive
                                                                                  Edge-Asset-Group: Shoreline
                                                                                  Sec-Fetch-Site: none
                                                                                  Sec-Fetch-Mode: no-cors
                                                                                  Sec-Fetch-Dest: empty
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:04 UTC577INHTTP/1.1 200 OK
                                                                                  Date: Sun, 01 Sep 2024 20:46:04 GMT
                                                                                  Content-Type: application/octet-stream
                                                                                  Content-Length: 306698
                                                                                  Connection: close
                                                                                  Content-Encoding: gzip
                                                                                  Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT
                                                                                  ETag: 0x8DBC9B5C40EBFF4
                                                                                  x-ms-request-id: c3ea0861-301e-0002-54a0-fc6afd000000
                                                                                  x-ms-version: 2009-09-19
                                                                                  x-ms-lease-status: unlocked
                                                                                  x-ms-blob-type: BlockBlob
                                                                                  x-azure-ref: 20240901T204604Z-16579567576s4v5z9ks8mdk6fw00000006sg00000000n85g
                                                                                  Cache-Control: public, max-age=604800
                                                                                  x-fd-int-roxy-purgeid: 0
                                                                                  X-Cache: TCP_HIT
                                                                                  X-Cache-Info: L1_T2
                                                                                  Accept-Ranges: bytes
                                                                                  2024-09-01 20:46:04 UTC15807INData Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe
                                                                                  Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&|'J'~eL|&c~6{JAw^z3cUEeMaTu W/^~b|X_?r~vXwW
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c
                                                                                  Data Ascii: u&U\h|[T[%6Q+"PR6mU5YgV-HoB /!~qL|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz|PVM&UOu~{-oM5QafAp
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d
                                                                                  Data Ascii: ,(T$&O7gkD$>U|}mlBxz*BFSzP~|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)|[U35QTB-
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80
                                                                                  Data Ascii: *B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:*_Gp`n3.e_j;`?ihbE}*Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqP
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e
                                                                                  Data Ascii: kp4k@?lk/IyMR\!1Q|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0o*j~~{Y1U}n|?*4>tk,OS]|w}:)y7gg3r#YU]oU~Cl.V
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7
                                                                                  Data Ascii: {M1eIwyfr;Tt5S};PtEr~*uVOLC=A{5__p*tHt|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1
                                                                                  Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03
                                                                                  Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40
                                                                                  Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;|.'Ocl7vUh&n{G]%vHN@
                                                                                  2024-09-01 20:46:04 UTC16384INData Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6
                                                                                  Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0*"1OvD#jK_F(Mu,abs&0`K`|'5Z:-#BoFX1-3JESJY(bJX*@D[93&Pq<jy@^2%S^?`>


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  6192.168.2.44976113.107.246.574437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:04 UTC486OUTGET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1
                                                                                  Host: edgeassetservice.azureedge.net
                                                                                  Connection: keep-alive
                                                                                  Edge-Asset-Group: ArbitrationService
                                                                                  Sec-Fetch-Site: none
                                                                                  Sec-Fetch-Mode: no-cors
                                                                                  Sec-Fetch-Dest: empty
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:04 UTC538INHTTP/1.1 200 OK
                                                                                  Date: Sun, 01 Sep 2024 20:46:04 GMT
                                                                                  Content-Type: application/octet-stream
                                                                                  Content-Length: 11989
                                                                                  Connection: close
                                                                                  Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT
                                                                                  ETag: 0x8DCC30802EF150E
                                                                                  x-ms-request-id: 903262f1-801e-001b-4826-f94695000000
                                                                                  x-ms-version: 2009-09-19
                                                                                  x-ms-lease-status: unlocked
                                                                                  x-ms-blob-type: BlockBlob
                                                                                  x-azure-ref: 20240901T204604Z-16579567576s4v5z9ks8mdk6fw00000006rg00000000rxmt
                                                                                  Cache-Control: public, max-age=604800
                                                                                  x-fd-int-roxy-purgeid: 69316365
                                                                                  X-Cache: TCP_HIT
                                                                                  Accept-Ranges: bytes
                                                                                  2024-09-01 20:46:04 UTC11989INData Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45
                                                                                  Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  7192.168.2.449770184.28.90.27443
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:05 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                                                                  Connection: Keep-Alive
                                                                                  Accept: */*
                                                                                  Accept-Encoding: identity
                                                                                  User-Agent: Microsoft BITS/7.8
                                                                                  Host: fs.microsoft.com
                                                                                  2024-09-01 20:46:05 UTC467INHTTP/1.1 200 OK
                                                                                  Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                                  Content-Type: application/octet-stream
                                                                                  ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                                  Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                                  Server: ECAcc (lpl/EF70)
                                                                                  X-CID: 11
                                                                                  X-Ms-ApiVersion: Distribute 1.2
                                                                                  X-Ms-Region: prod-neu-z1
                                                                                  Cache-Control: public, max-age=158375
                                                                                  Date: Sun, 01 Sep 2024 20:46:05 GMT
                                                                                  Connection: close
                                                                                  X-CID: 2


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  8192.168.2.449773184.28.90.27443
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:06 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                                                                  Connection: Keep-Alive
                                                                                  Accept: */*
                                                                                  Accept-Encoding: identity
                                                                                  If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                                                  Range: bytes=0-2147483646
                                                                                  User-Agent: Microsoft BITS/7.8
                                                                                  Host: fs.microsoft.com
                                                                                  2024-09-01 20:46:06 UTC515INHTTP/1.1 200 OK
                                                                                  ApiVersion: Distribute 1.1
                                                                                  Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                                  Content-Type: application/octet-stream
                                                                                  ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                                  Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                                  Server: ECAcc (lpl/EF06)
                                                                                  X-CID: 11
                                                                                  X-Ms-ApiVersion: Distribute 1.2
                                                                                  X-Ms-Region: prod-weu-z1
                                                                                  Cache-Control: public, max-age=158374
                                                                                  Date: Sun, 01 Sep 2024 20:46:06 GMT
                                                                                  Content-Length: 55
                                                                                  Connection: close
                                                                                  X-CID: 2
                                                                                  2024-09-01 20:46:06 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                                                  Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  9192.168.2.449774142.250.80.464437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:06 UTC579OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                  Host: play.google.com
                                                                                  Connection: keep-alive
                                                                                  Accept: */*
                                                                                  Access-Control-Request-Method: POST
                                                                                  Access-Control-Request-Headers: x-goog-authuser
                                                                                  Origin: https://accounts.google.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  Sec-Fetch-Mode: cors
                                                                                  Sec-Fetch-Site: same-site
                                                                                  Sec-Fetch-Dest: empty
                                                                                  Referer: https://accounts.google.com/
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:06 UTC520INHTTP/1.1 200 OK
                                                                                  Access-Control-Allow-Origin: https://accounts.google.com
                                                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                  Access-Control-Max-Age: 86400
                                                                                  Access-Control-Allow-Credentials: true
                                                                                  Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                                                  Content-Type: text/plain; charset=UTF-8
                                                                                  Date: Sun, 01 Sep 2024 20:46:06 GMT
                                                                                  Server: Playlog
                                                                                  Content-Length: 0
                                                                                  X-XSS-Protection: 0
                                                                                  X-Frame-Options: SAMEORIGIN
                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                  Connection: close


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  10192.168.2.449775142.250.80.464437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:06 UTC579OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                  Host: play.google.com
                                                                                  Connection: keep-alive
                                                                                  Accept: */*
                                                                                  Access-Control-Request-Method: POST
                                                                                  Access-Control-Request-Headers: x-goog-authuser
                                                                                  Origin: https://accounts.google.com
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  Sec-Fetch-Mode: cors
                                                                                  Sec-Fetch-Site: same-site
                                                                                  Sec-Fetch-Dest: empty
                                                                                  Referer: https://accounts.google.com/
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:06 UTC520INHTTP/1.1 200 OK
                                                                                  Access-Control-Allow-Origin: https://accounts.google.com
                                                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                  Access-Control-Max-Age: 86400
                                                                                  Access-Control-Allow-Credentials: true
                                                                                  Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                                                  Content-Type: text/plain; charset=UTF-8
                                                                                  Date: Sun, 01 Sep 2024 20:46:06 GMT
                                                                                  Server: Playlog
                                                                                  Content-Length: 0
                                                                                  X-XSS-Protection: 0
                                                                                  X-Frame-Options: SAMEORIGIN
                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                  Connection: close


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  11192.168.2.449776142.250.65.1964437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:07 UTC899OUTGET /favicon.ico HTTP/1.1
                                                                                  Host: www.google.com
                                                                                  Connection: keep-alive
                                                                                  sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                  sec-ch-ua-mobile: ?0
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  sec-ch-ua-arch: "x86"
                                                                                  sec-ch-ua-full-version: "117.0.2045.47"
                                                                                  sec-ch-ua-platform-version: "10.0.0"
                                                                                  sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                                                  sec-ch-ua-bitness: "64"
                                                                                  sec-ch-ua-model: ""
                                                                                  sec-ch-ua-wow64: ?0
                                                                                  sec-ch-ua-platform: "Windows"
                                                                                  Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                  Sec-Fetch-Site: same-site
                                                                                  Sec-Fetch-Mode: no-cors
                                                                                  Sec-Fetch-Dest: image
                                                                                  Referer: https://accounts.google.com/
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:07 UTC704INHTTP/1.1 200 OK
                                                                                  Accept-Ranges: bytes
                                                                                  Cross-Origin-Resource-Policy: cross-origin
                                                                                  Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
                                                                                  Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
                                                                                  Content-Length: 5430
                                                                                  X-Content-Type-Options: nosniff
                                                                                  Server: sffe
                                                                                  X-XSS-Protection: 0
                                                                                  Date: Sun, 01 Sep 2024 20:31:58 GMT
                                                                                  Expires: Mon, 09 Sep 2024 20:31:58 GMT
                                                                                  Cache-Control: public, max-age=691200
                                                                                  Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
                                                                                  Content-Type: image/x-icon
                                                                                  Vary: Accept-Encoding
                                                                                  Age: 849
                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                  Connection: close
                                                                                  2024-09-01 20:46:07 UTC686INData Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff
                                                                                  Data Ascii: h& ( 0.v]X:X:rY
                                                                                  2024-09-01 20:46:07 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb
                                                                                  Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
                                                                                  2024-09-01 20:46:07 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc
                                                                                  Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
                                                                                  2024-09-01 20:46:07 UTC1390INData Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                  Data Ascii: BBBBBBF!4I
                                                                                  2024-09-01 20:46:07 UTC574INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                  Data Ascii: $'


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  12192.168.2.449779142.251.32.1064437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:08 UTC448OUTPOST /chromewebstore/v1.1/items/verify HTTP/1.1
                                                                                  Host: www.googleapis.com
                                                                                  Connection: keep-alive
                                                                                  Content-Length: 119
                                                                                  Content-Type: application/json
                                                                                  Sec-Fetch-Site: none
                                                                                  Sec-Fetch-Mode: no-cors
                                                                                  Sec-Fetch-Dest: empty
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:08 UTC119OUTData Raw: 7b 22 68 61 73 68 22 3a 22 75 6f 51 66 61 45 34 39 76 73 52 33 4f 57 4e 75 61 2f 31 68 67 30 2b 42 54 57 42 53 73 56 6e 6e 4a 6a 77 79 79 4d 55 76 63 2b 4d 3d 22 2c 22 69 64 73 22 3a 5b 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d
                                                                                  Data Ascii: {"hash":"uoQfaE49vsR3OWNua/1hg0+BTWBSsVnnJjwyyMUvc+M=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}
                                                                                  2024-09-01 20:46:08 UTC341INHTTP/1.1 200 OK
                                                                                  Content-Type: application/json; charset=UTF-8
                                                                                  Vary: Origin
                                                                                  Vary: X-Origin
                                                                                  Vary: Referer
                                                                                  Date: Sun, 01 Sep 2024 20:46:08 GMT
                                                                                  Server: ESF
                                                                                  Content-Length: 483
                                                                                  X-XSS-Protection: 0
                                                                                  X-Frame-Options: SAMEORIGIN
                                                                                  X-Content-Type-Options: nosniff
                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                  Connection: close
                                                                                  2024-09-01 20:46:08 UTC483INData Raw: 7b 0a 20 20 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 20 31 2c 0a 20 20 22 73 69 67 6e 61 74 75 72 65 22 3a 20 22 4c 55 61 79 34 2b 74 6b 76 6f 77 36 6b 6d 73 4b 5a 34 53 56 6b 77 43 7a 66 35 71 71 72 43 55 46 69 4a 70 4f 41 58 4f 52 48 77 52 34 32 64 30 58 52 47 42 46 72 4e 48 7a 48 49 78 46 6a 70 63 71 67 36 38 6b 70 4e 62 38 33 68 7a 6d 69 47 78 2f 68 78 72 6b 6c 63 76 67 74 6e 45 41 38 56 49 38 70 45 48 6b 6a 44 5a 2f 4f 50 36 75 46 30 59 75 50 37 41 79 79 2f 37 36 6a 4f 41 65 36 58 4c 6a 44 44 2f 62 34 78 4b 6c 47 6e 45 70 65 41 35 51 6a 77 35 50 52 41 58 4b 6a 6d 35 4c 74 37 68 45 69 76 50 79 70 72 4b 63 65 70 51 66 72 77 43 59 51 68 45 33 56 4f 72 72 6c 38 79 58 2b 56 71 44 4f 56 72 45 49 4f 6e 74 79 6e 2f 56 5a 38 61 65 66 67 53 36
                                                                                  Data Ascii: { "protocol_version": 1, "signature": "LUay4+tkvow6kmsKZ4SVkwCzf5qqrCUFiJpOAXORHwR42d0XRGBFrNHzHIxFjpcqg68kpNb83hzmiGx/hxrklcvgtnEA8VI8pEHkjDZ/OP6uF0YuP7Ayy/76jOAe6XLjDD/b4xKlGnEpeA5Qjw5PRAXKjm5Lt7hEivPyprKcepQfrwCYQhE3VOrrl8yX+VqDOVrEIOntyn/VZ8aefgS6


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  13192.168.2.44978013.85.23.86443
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:12 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dOKndhuHwpLNGYN&MD=PtaPUhX6 HTTP/1.1
                                                                                  Connection: Keep-Alive
                                                                                  Accept: */*
                                                                                  User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                  Host: slscr.update.microsoft.com
                                                                                  2024-09-01 20:46:13 UTC560INHTTP/1.1 200 OK
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Content-Type: application/octet-stream
                                                                                  Expires: -1
                                                                                  Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                  ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                                                  MS-CorrelationId: 1d44eb10-9e85-4ecb-8511-34beec90b76c
                                                                                  MS-RequestId: 292fadea-b1be-4547-a8fe-8b71094d67d7
                                                                                  MS-CV: DaYPIg3BgUGTjyrj.0
                                                                                  X-Microsoft-SLSClientCache: 2880
                                                                                  Content-Disposition: attachment; filename=environment.cab
                                                                                  X-Content-Type-Options: nosniff
                                                                                  Date: Sun, 01 Sep 2024 20:46:12 GMT
                                                                                  Connection: close
                                                                                  Content-Length: 24490
                                                                                  2024-09-01 20:46:13 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                                                  Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                                                  2024-09-01 20:46:13 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                                                  Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  14192.168.2.449786152.195.19.974437988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:20 UTC614OUTGET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725828361&P2=404&P3=2&P4=M5a2BJv5Ws434Qm11Ke2v0mxXAO551xEHIrvdezjAm6vppj3WexPYJie3hJd6X4TcMBd4lruncSnByi1G%2bmQgw%3d%3d HTTP/1.1
                                                                                  Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
                                                                                  Connection: keep-alive
                                                                                  MS-CV: rQA6HT74DpI9FtRW7IHx4v
                                                                                  Sec-Fetch-Site: none
                                                                                  Sec-Fetch-Mode: no-cors
                                                                                  Sec-Fetch-Dest: empty
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                  2024-09-01 20:46:20 UTC632INHTTP/1.1 200 OK
                                                                                  Accept-Ranges: bytes
                                                                                  Age: 5150111
                                                                                  Cache-Control: public, max-age=17280000
                                                                                  Content-Type: application/x-chrome-extension
                                                                                  Date: Sun, 01 Sep 2024 20:46:20 GMT
                                                                                  Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8="
                                                                                  Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT
                                                                                  MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31
                                                                                  MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0
                                                                                  MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4
                                                                                  Server: ECAcc (nyd/D11E)
                                                                                  X-AspNet-Version: 4.0.30319
                                                                                  X-AspNetMvc-Version: 5.3
                                                                                  X-Cache: HIT
                                                                                  X-CCC: US
                                                                                  X-CID: 11
                                                                                  X-Powered-By: ASP.NET
                                                                                  X-Powered-By: ARR/3.0
                                                                                  X-Powered-By: ASP.NET
                                                                                  Content-Length: 11185
                                                                                  Connection: close
                                                                                  2024-09-01 20:46:20 UTC11185INData Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20
                                                                                  Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  15192.168.2.45043813.85.23.206443
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:29 UTC142OUTGET /clientwebservice/ping HTTP/1.1
                                                                                  Connection: Keep-Alive
                                                                                  User-Agent: DNS resiliency checker/1.0
                                                                                  Host: fe3cr.delivery.mp.microsoft.com
                                                                                  2024-09-01 20:46:30 UTC234INHTTP/1.1 200 OK
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Expires: -1
                                                                                  Server: Microsoft-IIS/10.0
                                                                                  X-Powered-By: ASP.NET
                                                                                  X-Content-Type-Options: nosniff
                                                                                  Date: Sun, 01 Sep 2024 20:46:29 GMT
                                                                                  Connection: close
                                                                                  Content-Length: 0


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  16192.168.2.45043940.68.123.157443
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:30 UTC124OUTGET /sls/ping HTTP/1.1
                                                                                  Connection: Keep-Alive
                                                                                  User-Agent: DNS resiliency checker/1.0
                                                                                  Host: slscr.update.microsoft.com
                                                                                  2024-09-01 20:46:31 UTC318INHTTP/1.1 200 OK
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Expires: -1
                                                                                  MS-CV: vJ2Vrj9Nw0+ubtIP.0
                                                                                  MS-RequestId: f271155c-e76f-43b2-ad2f-7a32e1ccf155
                                                                                  MS-CorrelationId: 6cb484e1-8cfc-4e40-bc77-6bde336680a8
                                                                                  X-Content-Type-Options: nosniff
                                                                                  Date: Sun, 01 Sep 2024 20:46:30 GMT
                                                                                  Connection: close
                                                                                  Content-Length: 0


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  17192.168.2.45044020.114.59.183443
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:34 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dOKndhuHwpLNGYN&MD=PtaPUhX6 HTTP/1.1
                                                                                  Connection: Keep-Alive
                                                                                  Accept: */*
                                                                                  User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                  Host: slscr.update.microsoft.com
                                                                                  2024-09-01 20:46:34 UTC560INHTTP/1.1 200 OK
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Content-Type: application/octet-stream
                                                                                  Expires: -1
                                                                                  Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                  ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                                                  MS-CorrelationId: dbe78883-c699-4e2a-95ef-31635dfe4d3f
                                                                                  MS-RequestId: c798c5cf-c5fb-47a8-a5a0-b78dedee0d8c
                                                                                  MS-CV: u8pKSxLfLEqwmneG.0
                                                                                  X-Microsoft-SLSClientCache: 2880
                                                                                  Content-Disposition: attachment; filename=environment.cab
                                                                                  X-Content-Type-Options: nosniff
                                                                                  Date: Sun, 01 Sep 2024 20:46:34 GMT
                                                                                  Connection: close
                                                                                  Content-Length: 24490
                                                                                  2024-09-01 20:46:34 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                                                  Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                                                  2024-09-01 20:46:34 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                                                  Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  18192.168.2.45044620.114.59.183443
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-09-01 20:46:35 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dOKndhuHwpLNGYN&MD=PtaPUhX6 HTTP/1.1
                                                                                  Connection: Keep-Alive
                                                                                  Accept: */*
                                                                                  User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                  Host: slscr.update.microsoft.com
                                                                                  2024-09-01 20:46:35 UTC560INHTTP/1.1 200 OK
                                                                                  Cache-Control: no-cache
                                                                                  Pragma: no-cache
                                                                                  Content-Type: application/octet-stream
                                                                                  Expires: -1
                                                                                  Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                  ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440"
                                                                                  MS-CorrelationId: 03987c72-4ba6-4019-a334-3412e29348cb
                                                                                  MS-RequestId: ff4c8145-74ad-4ef3-8e97-00d58ecd162a
                                                                                  MS-CV: DXP1GAZQQkKCKAIc.0
                                                                                  X-Microsoft-SLSClientCache: 1440
                                                                                  Content-Disposition: attachment; filename=environment.cab
                                                                                  X-Content-Type-Options: nosniff
                                                                                  Date: Sun, 01 Sep 2024 20:46:34 GMT
                                                                                  Connection: close
                                                                                  Content-Length: 30005
                                                                                  2024-09-01 20:46:35 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e
                                                                                  Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
                                                                                  2024-09-01 20:46:35 UTC14181INData Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f
                                                                                  Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro


                                                                                  Statistics

                                                                                  CPU Usage

                                                                                  Click to jump to process

                                                                                  Memory Usage

                                                                                  Click to jump to process

                                                                                  High Level Behavior Distribution

                                                                                  Click to dive into process behavior distribution

                                                                                  Behavior

                                                                                  Click to jump to process

                                                                                  System Behavior

                                                                                  General

                                                                                  Target ID:0
                                                                                  Start time:16:45:53
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Users\user\Desktop\file.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Users\user\Desktop\file.exe"
                                                                                  Imagebase:0x650000
                                                                                  File size:917'504 bytes
                                                                                  MD5 hash:B129D4053A168A3D69FED0A5C1088353
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:low
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:1
                                                                                  Start time:16:45:53
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:2
                                                                                  Start time:16:45:53
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                                  Imagebase:0x7ff6bf500000
                                                                                  File size:676'768 bytes
                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:4
                                                                                  Start time:16:45:53
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation
                                                                                  Imagebase:0x7ff6bf500000
                                                                                  File size:676'768 bytes
                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:5
                                                                                  Start time:16:45:54
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                                  Imagebase:0x7ff6bf500000
                                                                                  File size:676'768 bytes
                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:false

                                                                                  General

                                                                                  Target ID:6
                                                                                  Start time:16:45:54
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2076,i,1828721353005406552,4286803318795052176,262144 /prefetch:3
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:7
                                                                                  Start time:16:45:54
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:false

                                                                                  General

                                                                                  Target ID:8
                                                                                  Start time:16:45:55
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:3
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:false

                                                                                  General

                                                                                  Target ID:10
                                                                                  Start time:16:45:59
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6360 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:11
                                                                                  Start time:16:45:59
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6556 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:12
                                                                                  Start time:16:45:59
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acc27241-3c31-435d-99e4-83922da2a76d} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b6bc6ed10 socket
                                                                                  Imagebase:0x7ff6bf500000
                                                                                  File size:676'768 bytes
                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:false

                                                                                  General

                                                                                  Target ID:14
                                                                                  Start time:16:46:01
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6816 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
                                                                                  Imagebase:0x7ff6fa000000
                                                                                  File size:1'255'976 bytes
                                                                                  MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:15
                                                                                  Start time:16:46:01
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6816 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
                                                                                  Imagebase:0x7ff6fa000000
                                                                                  File size:1'255'976 bytes
                                                                                  MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:16
                                                                                  Start time:16:46:04
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4260 -parentBuildID 20230927232528 -prefsHandle 4620 -prefMapHandle 3896 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cd84140-ac0b-45b4-9542-7f422c07c9d5} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b78b57710 rdd
                                                                                  Imagebase:0x7ff6bf500000
                                                                                  File size:676'768 bytes
                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:false

                                                                                  General

                                                                                  Target ID:18
                                                                                  Start time:16:46:12
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:19
                                                                                  Start time:16:46:12
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,12420635758166294745,5105143302083340951,262144 /prefetch:3
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:22
                                                                                  Start time:16:46:20
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:23
                                                                                  Start time:16:46:20
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1980,i,9697535281678700936,11038712812997427642,262144 /prefetch:3
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:24
                                                                                  Start time:16:46:45
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 33865 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e192372e-be7d-4bb5-b0f1-d46844c70d01} 7584 "\\.\pipe\gecko-crash-server-pipe.7584" 21b87784910 utility
                                                                                  Imagebase:0x7ff6bf500000
                                                                                  File size:676'768 bytes
                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:false

                                                                                  General

                                                                                  Target ID:25
                                                                                  Start time:16:46:55
                                                                                  Start date:01/09/2024
                                                                                  Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6736 --field-trial-handle=2360,i,15383655831768038927,11961780736375890449,262144 /prefetch:8
                                                                                  Imagebase:0x7ff67dcd0000
                                                                                  File size:4'210'216 bytes
                                                                                  MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:false

                                                                                  Disassembly

                                                                                  Reset < >

                                                                                    Execution Graph

                                                                                    Execution Coverage:1.9%
                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                    Signature Coverage:7.3%
                                                                                    Total number of Nodes:1406
                                                                                    Total number of Limit Nodes:40
                                                                                    execution_graph 94125 651044 94130 6510f3 94125->94130 94127 65104a 94166 6700a3 29 API calls __onexit 94127->94166 94129 651054 94167 651398 94130->94167 94134 65116a 94177 65a961 94134->94177 94137 65a961 22 API calls 94138 65117e 94137->94138 94139 65a961 22 API calls 94138->94139 94140 651188 94139->94140 94141 65a961 22 API calls 94140->94141 94142 6511c6 94141->94142 94143 65a961 22 API calls 94142->94143 94144 651292 94143->94144 94182 65171c 94144->94182 94148 6512c4 94149 65a961 22 API calls 94148->94149 94150 6512ce 94149->94150 94203 661940 94150->94203 94152 6512f9 94213 651aab 94152->94213 94154 651315 94155 651325 GetStdHandle 94154->94155 94156 692485 94155->94156 94157 65137a 94155->94157 94156->94157 94158 69248e 94156->94158 94160 651387 OleInitialize 94157->94160 94220 66fddb 94158->94220 94160->94127 94161 692495 94230 6c011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 94161->94230 94163 69249e 94231 6c0944 CreateThread 94163->94231 94165 6924aa CloseHandle 94165->94157 94166->94129 94232 6513f1 94167->94232 94170 6513f1 22 API calls 94171 6513d0 94170->94171 94172 65a961 22 API calls 94171->94172 94173 6513dc 94172->94173 94239 656b57 94173->94239 94175 651129 94176 651bc3 6 API calls 94175->94176 94176->94134 94178 66fe0b 22 API calls 94177->94178 94179 65a976 94178->94179 94180 66fddb 22 API calls 94179->94180 94181 651174 94180->94181 94181->94137 94183 65a961 22 API calls 94182->94183 94184 65172c 94183->94184 94185 65a961 22 API calls 94184->94185 94186 651734 94185->94186 94187 65a961 22 API calls 94186->94187 94188 65174f 94187->94188 94189 66fddb 22 API calls 94188->94189 94190 65129c 94189->94190 94191 651b4a 94190->94191 94192 651b58 94191->94192 94193 65a961 22 API calls 94192->94193 94194 651b63 94193->94194 94195 65a961 22 API calls 94194->94195 94196 651b6e 94195->94196 94197 65a961 22 API calls 94196->94197 94198 651b79 94197->94198 94199 65a961 22 API calls 94198->94199 94200 651b84 94199->94200 94201 66fddb 22 API calls 94200->94201 94202 651b96 RegisterWindowMessageW 94201->94202 94202->94148 94204 661981 94203->94204 94205 66195d 94203->94205 94284 670242 5 API calls __Init_thread_wait 94204->94284 94212 66196e 94205->94212 94286 670242 5 API calls __Init_thread_wait 94205->94286 94208 66198b 94208->94205 94285 6701f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 94208->94285 94209 668727 94209->94212 94287 6701f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 94209->94287 94212->94152 94214 69272d 94213->94214 94215 651abb 94213->94215 94288 6c3209 23 API calls 94214->94288 94216 66fddb 22 API calls 94215->94216 94218 651ac3 94216->94218 94218->94154 94219 692738 94221 66fde0 94220->94221 94222 67ea0c ___std_exception_copy 21 API calls 94221->94222 94223 66fdfa 94221->94223 94226 66fdfc 94221->94226 94289 674ead 7 API calls 2 library calls 94221->94289 94222->94221 94223->94161 94225 67066d 94291 6732a4 RaiseException 94225->94291 94226->94225 94290 6732a4 RaiseException 94226->94290 94229 67068a 94229->94161 94230->94163 94231->94165 94292 6c092a 28 API calls 94231->94292 94233 65a961 22 API calls 94232->94233 94234 6513fc 94233->94234 94235 65a961 22 API calls 94234->94235 94236 651404 94235->94236 94237 65a961 22 API calls 94236->94237 94238 6513c6 94237->94238 94238->94170 94240 656b67 _wcslen 94239->94240 94241 694ba1 94239->94241 94244 656ba2 94240->94244 94245 656b7d 94240->94245 94262 6593b2 94241->94262 94243 694baa 94243->94243 94246 66fddb 22 API calls 94244->94246 94251 656f34 22 API calls 94245->94251 94248 656bae 94246->94248 94252 66fe0b 94248->94252 94249 656b85 __fread_nolock 94249->94175 94251->94249 94254 66fddb 94252->94254 94255 66fdfa 94254->94255 94257 66fdfc 94254->94257 94266 67ea0c 94254->94266 94273 674ead 7 API calls 2 library calls 94254->94273 94255->94249 94261 67066d 94257->94261 94274 6732a4 RaiseException 94257->94274 94260 67068a 94260->94249 94275 6732a4 RaiseException 94261->94275 94263 6593c0 94262->94263 94265 6593c9 __fread_nolock 94262->94265 94263->94265 94278 65aec9 94263->94278 94265->94243 94271 683820 __dosmaperr 94266->94271 94267 68385e 94277 67f2d9 20 API calls __dosmaperr 94267->94277 94268 683849 RtlAllocateHeap 94270 68385c 94268->94270 94268->94271 94270->94254 94271->94267 94271->94268 94276 674ead 7 API calls 2 library calls 94271->94276 94273->94254 94274->94261 94275->94260 94276->94271 94277->94270 94279 65aedc 94278->94279 94280 65aed9 __fread_nolock 94278->94280 94281 66fddb 22 API calls 94279->94281 94280->94265 94282 65aee7 94281->94282 94283 66fe0b 22 API calls 94282->94283 94283->94280 94284->94208 94285->94205 94286->94209 94287->94212 94288->94219 94289->94221 94290->94225 94291->94229 94293 652de3 94294 652df0 __wsopen_s 94293->94294 94295 692c2b ___scrt_fastfail 94294->94295 94296 652e09 94294->94296 94299 692c47 GetOpenFileNameW 94295->94299 94309 653aa2 94296->94309 94301 692c96 94299->94301 94303 656b57 22 API calls 94301->94303 94304 692cab 94303->94304 94304->94304 94306 652e27 94337 6544a8 94306->94337 94366 691f50 94309->94366 94312 653ace 94314 656b57 22 API calls 94312->94314 94313 653ae9 94372 65a6c3 94313->94372 94316 653ada 94314->94316 94368 6537a0 94316->94368 94319 652da5 94320 691f50 __wsopen_s 94319->94320 94321 652db2 GetLongPathNameW 94320->94321 94322 656b57 22 API calls 94321->94322 94323 652dda 94322->94323 94324 653598 94323->94324 94325 65a961 22 API calls 94324->94325 94326 6535aa 94325->94326 94327 653aa2 23 API calls 94326->94327 94328 6535b5 94327->94328 94329 6932eb 94328->94329 94330 6535c0 94328->94330 94335 69330d 94329->94335 94390 66ce60 41 API calls 94329->94390 94378 65515f 94330->94378 94336 6535df 94336->94306 94391 654ecb 94337->94391 94340 693833 94413 6c2cf9 94340->94413 94341 654ecb 94 API calls 94343 6544e1 94341->94343 94343->94340 94345 6544e9 94343->94345 94344 693848 94346 693869 94344->94346 94347 69384c 94344->94347 94349 6544f5 94345->94349 94350 693854 94345->94350 94348 66fe0b 22 API calls 94346->94348 94440 654f39 94347->94440 94365 6938ae 94348->94365 94439 65940c 136 API calls 2 library calls 94349->94439 94446 6bda5a 82 API calls 94350->94446 94354 652e31 94355 693862 94355->94346 94356 654f39 68 API calls 94359 693a5f 94356->94359 94359->94356 94452 6b989b 82 API calls __wsopen_s 94359->94452 94362 659cb3 22 API calls 94362->94365 94365->94359 94365->94362 94447 6b967e 22 API calls __fread_nolock 94365->94447 94448 6b95ad 42 API calls _wcslen 94365->94448 94449 6c0b5a 22 API calls 94365->94449 94450 65a4a1 22 API calls __fread_nolock 94365->94450 94451 653ff7 22 API calls 94365->94451 94367 653aaf GetFullPathNameW 94366->94367 94367->94312 94367->94313 94369 6537ae 94368->94369 94370 6593b2 22 API calls 94369->94370 94371 652e12 94370->94371 94371->94319 94373 65a6dd 94372->94373 94377 65a6d0 94372->94377 94374 66fddb 22 API calls 94373->94374 94375 65a6e7 94374->94375 94376 66fe0b 22 API calls 94375->94376 94376->94377 94377->94316 94379 65516e 94378->94379 94383 65518f __fread_nolock 94378->94383 94382 66fe0b 22 API calls 94379->94382 94380 66fddb 22 API calls 94381 6535cc 94380->94381 94384 6535f3 94381->94384 94382->94383 94383->94380 94385 653605 94384->94385 94389 653624 __fread_nolock 94384->94389 94387 66fe0b 22 API calls 94385->94387 94386 66fddb 22 API calls 94388 65363b 94386->94388 94387->94389 94388->94336 94389->94386 94390->94329 94453 654e90 LoadLibraryA 94391->94453 94396 654ef6 LoadLibraryExW 94461 654e59 LoadLibraryA 94396->94461 94397 693ccf 94398 654f39 68 API calls 94397->94398 94400 693cd6 94398->94400 94402 654e59 3 API calls 94400->94402 94404 693cde 94402->94404 94483 6550f5 94404->94483 94405 654f20 94405->94404 94406 654f2c 94405->94406 94408 654f39 68 API calls 94406->94408 94410 6544cd 94408->94410 94410->94340 94410->94341 94412 693d05 94414 6c2d15 94413->94414 94415 65511f 64 API calls 94414->94415 94416 6c2d29 94415->94416 94633 6c2e66 94416->94633 94419 6550f5 40 API calls 94420 6c2d56 94419->94420 94421 6550f5 40 API calls 94420->94421 94422 6c2d66 94421->94422 94423 6550f5 40 API calls 94422->94423 94424 6c2d81 94423->94424 94425 6550f5 40 API calls 94424->94425 94426 6c2d9c 94425->94426 94427 65511f 64 API calls 94426->94427 94428 6c2db3 94427->94428 94429 67ea0c ___std_exception_copy 21 API calls 94428->94429 94430 6c2dba 94429->94430 94431 67ea0c ___std_exception_copy 21 API calls 94430->94431 94432 6c2dc4 94431->94432 94433 6550f5 40 API calls 94432->94433 94434 6c2dd8 94433->94434 94435 6c28fe 27 API calls 94434->94435 94436 6c2dee 94435->94436 94437 6c2d3f 94436->94437 94639 6c22ce 79 API calls 94436->94639 94437->94344 94439->94354 94441 654f43 94440->94441 94442 654f4a 94440->94442 94640 67e678 94441->94640 94444 654f59 94442->94444 94445 654f6a FreeLibrary 94442->94445 94444->94350 94445->94444 94446->94355 94447->94365 94448->94365 94449->94365 94450->94365 94451->94365 94452->94359 94454 654ec6 94453->94454 94455 654ea8 GetProcAddress 94453->94455 94458 67e5eb 94454->94458 94456 654eb8 94455->94456 94456->94454 94457 654ebf FreeLibrary 94456->94457 94457->94454 94491 67e52a 94458->94491 94460 654eea 94460->94396 94460->94397 94462 654e8d 94461->94462 94463 654e6e GetProcAddress 94461->94463 94466 654f80 94462->94466 94464 654e7e 94463->94464 94464->94462 94465 654e86 FreeLibrary 94464->94465 94465->94462 94467 66fe0b 22 API calls 94466->94467 94468 654f95 94467->94468 94559 655722 94468->94559 94470 654fa1 __fread_nolock 94471 6550a5 94470->94471 94472 693d1d 94470->94472 94479 654fdc 94470->94479 94562 6542a2 CreateStreamOnHGlobal 94471->94562 94573 6c304d 74 API calls 94472->94573 94475 693d22 94477 65511f 64 API calls 94475->94477 94476 6550f5 40 API calls 94476->94479 94478 693d45 94477->94478 94480 6550f5 40 API calls 94478->94480 94479->94475 94479->94476 94481 65506e messages 94479->94481 94568 65511f 94479->94568 94480->94481 94481->94405 94484 655107 94483->94484 94487 693d70 94483->94487 94595 67e8c4 94484->94595 94488 6c28fe 94616 6c274e 94488->94616 94490 6c2919 94490->94412 94492 67e536 BuildCatchObjectHelperInternal 94491->94492 94493 67e544 94492->94493 94496 67e574 94492->94496 94516 67f2d9 20 API calls __dosmaperr 94493->94516 94495 67e549 94517 6827ec 26 API calls pre_c_initialization 94495->94517 94498 67e586 94496->94498 94499 67e579 94496->94499 94508 688061 94498->94508 94518 67f2d9 20 API calls __dosmaperr 94499->94518 94502 67e58f 94503 67e595 94502->94503 94504 67e5a2 94502->94504 94519 67f2d9 20 API calls __dosmaperr 94503->94519 94520 67e5d4 LeaveCriticalSection __fread_nolock 94504->94520 94506 67e554 __wsopen_s 94506->94460 94509 68806d BuildCatchObjectHelperInternal 94508->94509 94521 682f5e EnterCriticalSection 94509->94521 94511 68807b 94522 6880fb 94511->94522 94515 6880ac __wsopen_s 94515->94502 94516->94495 94517->94506 94518->94506 94519->94506 94520->94506 94521->94511 94523 68811e 94522->94523 94524 688177 94523->94524 94531 688088 94523->94531 94538 67918d EnterCriticalSection 94523->94538 94539 6791a1 LeaveCriticalSection 94523->94539 94540 684c7d 94524->94540 94529 688189 94529->94531 94553 683405 11 API calls 2 library calls 94529->94553 94535 6880b7 94531->94535 94532 6881a8 94554 67918d EnterCriticalSection 94532->94554 94558 682fa6 LeaveCriticalSection 94535->94558 94537 6880be 94537->94515 94538->94523 94539->94523 94546 684c8a __dosmaperr 94540->94546 94541 684cca 94556 67f2d9 20 API calls __dosmaperr 94541->94556 94542 684cb5 RtlAllocateHeap 94543 684cc8 94542->94543 94542->94546 94547 6829c8 94543->94547 94546->94541 94546->94542 94555 674ead 7 API calls 2 library calls 94546->94555 94548 6829d3 RtlFreeHeap 94547->94548 94552 6829fc __dosmaperr 94547->94552 94549 6829e8 94548->94549 94548->94552 94557 67f2d9 20 API calls __dosmaperr 94549->94557 94551 6829ee GetLastError 94551->94552 94552->94529 94553->94532 94554->94531 94555->94546 94556->94543 94557->94551 94558->94537 94560 66fddb 22 API calls 94559->94560 94561 655734 94560->94561 94561->94470 94563 6542bc FindResourceExW 94562->94563 94567 6542d9 94562->94567 94564 6935ba LoadResource 94563->94564 94563->94567 94565 6935cf SizeofResource 94564->94565 94564->94567 94566 6935e3 LockResource 94565->94566 94565->94567 94566->94567 94567->94479 94569 693d90 94568->94569 94570 65512e 94568->94570 94574 67ece3 94570->94574 94573->94475 94577 67eaaa 94574->94577 94576 65513c 94576->94479 94580 67eab6 BuildCatchObjectHelperInternal 94577->94580 94578 67eac2 94590 67f2d9 20 API calls __dosmaperr 94578->94590 94580->94578 94581 67eae8 94580->94581 94592 67918d EnterCriticalSection 94581->94592 94583 67eac7 94591 6827ec 26 API calls pre_c_initialization 94583->94591 94584 67eaf4 94593 67ec0a 62 API calls 2 library calls 94584->94593 94587 67eb08 94594 67eb27 LeaveCriticalSection __fread_nolock 94587->94594 94589 67ead2 __wsopen_s 94589->94576 94590->94583 94591->94589 94592->94584 94593->94587 94594->94589 94598 67e8e1 94595->94598 94597 655118 94597->94488 94599 67e8ed BuildCatchObjectHelperInternal 94598->94599 94600 67e92d 94599->94600 94601 67e925 __wsopen_s 94599->94601 94605 67e900 ___scrt_fastfail 94599->94605 94613 67918d EnterCriticalSection 94600->94613 94601->94597 94604 67e937 94614 67e6f8 38 API calls 4 library calls 94604->94614 94611 67f2d9 20 API calls __dosmaperr 94605->94611 94606 67e91a 94612 6827ec 26 API calls pre_c_initialization 94606->94612 94609 67e94e 94615 67e96c LeaveCriticalSection __fread_nolock 94609->94615 94611->94606 94612->94601 94613->94604 94614->94609 94615->94601 94619 67e4e8 94616->94619 94618 6c275d 94618->94490 94622 67e469 94619->94622 94621 67e505 94621->94618 94623 67e48c 94622->94623 94624 67e478 94622->94624 94629 67e488 __alldvrm 94623->94629 94632 68333f 11 API calls 2 library calls 94623->94632 94630 67f2d9 20 API calls __dosmaperr 94624->94630 94626 67e47d 94631 6827ec 26 API calls pre_c_initialization 94626->94631 94629->94621 94630->94626 94631->94629 94632->94629 94638 6c2e7a 94633->94638 94634 6550f5 40 API calls 94634->94638 94635 6c2d3b 94635->94419 94635->94437 94636 6c28fe 27 API calls 94636->94638 94637 65511f 64 API calls 94637->94638 94638->94634 94638->94635 94638->94636 94638->94637 94639->94437 94641 67e684 BuildCatchObjectHelperInternal 94640->94641 94642 67e695 94641->94642 94643 67e6aa 94641->94643 94653 67f2d9 20 API calls __dosmaperr 94642->94653 94652 67e6a5 __wsopen_s 94643->94652 94655 67918d EnterCriticalSection 94643->94655 94645 67e69a 94654 6827ec 26 API calls pre_c_initialization 94645->94654 94648 67e6c6 94656 67e602 94648->94656 94650 67e6d1 94672 67e6ee LeaveCriticalSection __fread_nolock 94650->94672 94652->94442 94653->94645 94654->94652 94655->94648 94657 67e624 94656->94657 94658 67e60f 94656->94658 94664 67e61f 94657->94664 94675 67dc0b 94657->94675 94673 67f2d9 20 API calls __dosmaperr 94658->94673 94660 67e614 94674 6827ec 26 API calls pre_c_initialization 94660->94674 94664->94650 94668 67e646 94692 68862f 94668->94692 94671 6829c8 _free 20 API calls 94671->94664 94672->94652 94673->94660 94674->94664 94676 67dc23 94675->94676 94677 67dc1f 94675->94677 94676->94677 94678 67d955 __fread_nolock 26 API calls 94676->94678 94681 684d7a 94677->94681 94679 67dc43 94678->94679 94707 6859be 62 API calls 4 library calls 94679->94707 94682 684d90 94681->94682 94684 67e640 94681->94684 94683 6829c8 _free 20 API calls 94682->94683 94682->94684 94683->94684 94685 67d955 94684->94685 94686 67d976 94685->94686 94687 67d961 94685->94687 94686->94668 94708 67f2d9 20 API calls __dosmaperr 94687->94708 94689 67d966 94709 6827ec 26 API calls pre_c_initialization 94689->94709 94691 67d971 94691->94668 94693 68863e 94692->94693 94698 688653 94692->94698 94710 67f2c6 20 API calls __dosmaperr 94693->94710 94695 68868e 94715 67f2c6 20 API calls __dosmaperr 94695->94715 94697 688643 94711 67f2d9 20 API calls __dosmaperr 94697->94711 94698->94695 94701 68867a 94698->94701 94699 688693 94716 67f2d9 20 API calls __dosmaperr 94699->94716 94712 688607 94701->94712 94704 67e64c 94704->94664 94704->94671 94705 68869b 94717 6827ec 26 API calls pre_c_initialization 94705->94717 94707->94677 94708->94689 94709->94691 94710->94697 94711->94704 94718 688585 94712->94718 94714 68862b 94714->94704 94715->94699 94716->94705 94717->94704 94719 688591 BuildCatchObjectHelperInternal 94718->94719 94729 685147 EnterCriticalSection 94719->94729 94721 68859f 94722 6885d1 94721->94722 94723 6885c6 94721->94723 94745 67f2d9 20 API calls __dosmaperr 94722->94745 94730 6886ae 94723->94730 94726 6885cc 94746 6885fb LeaveCriticalSection __wsopen_s 94726->94746 94728 6885ee __wsopen_s 94728->94714 94729->94721 94747 6853c4 94730->94747 94732 6886c4 94760 685333 21 API calls 2 library calls 94732->94760 94733 6886be 94733->94732 94735 6853c4 __wsopen_s 26 API calls 94733->94735 94744 6886f6 94733->94744 94738 6886ed 94735->94738 94736 6853c4 __wsopen_s 26 API calls 94739 688702 FindCloseChangeNotification 94736->94739 94737 68871c 94740 68873e 94737->94740 94761 67f2a3 20 API calls __dosmaperr 94737->94761 94741 6853c4 __wsopen_s 26 API calls 94738->94741 94739->94732 94742 68870e GetLastError 94739->94742 94740->94726 94741->94744 94742->94732 94744->94732 94744->94736 94745->94726 94746->94728 94748 6853d1 94747->94748 94749 6853e6 94747->94749 94762 67f2c6 20 API calls __dosmaperr 94748->94762 94754 68540b 94749->94754 94764 67f2c6 20 API calls __dosmaperr 94749->94764 94751 6853d6 94763 67f2d9 20 API calls __dosmaperr 94751->94763 94754->94733 94755 685416 94765 67f2d9 20 API calls __dosmaperr 94755->94765 94757 6853de 94757->94733 94758 68541e 94766 6827ec 26 API calls pre_c_initialization 94758->94766 94760->94737 94761->94740 94762->94751 94763->94757 94764->94755 94765->94758 94766->94757 94767 651cad SystemParametersInfoW 94768 688402 94773 6881be 94768->94773 94771 68842a 94778 6881ef try_get_first_available_module 94773->94778 94775 6883ee 94792 6827ec 26 API calls pre_c_initialization 94775->94792 94777 688343 94777->94771 94785 690984 94777->94785 94781 688338 94778->94781 94788 678e0b 40 API calls 2 library calls 94778->94788 94780 68838c 94780->94781 94789 678e0b 40 API calls 2 library calls 94780->94789 94781->94777 94791 67f2d9 20 API calls __dosmaperr 94781->94791 94783 6883ab 94783->94781 94790 678e0b 40 API calls 2 library calls 94783->94790 94793 690081 94785->94793 94787 69099f 94787->94771 94788->94780 94789->94783 94790->94781 94791->94775 94792->94777 94796 69008d BuildCatchObjectHelperInternal 94793->94796 94794 69009b 94850 67f2d9 20 API calls __dosmaperr 94794->94850 94796->94794 94798 6900d4 94796->94798 94797 6900a0 94851 6827ec 26 API calls pre_c_initialization 94797->94851 94804 69065b 94798->94804 94803 6900aa __wsopen_s 94803->94787 94805 690678 94804->94805 94806 69068d 94805->94806 94807 6906a6 94805->94807 94867 67f2c6 20 API calls __dosmaperr 94806->94867 94853 685221 94807->94853 94810 6906ab 94811 6906cb 94810->94811 94812 6906b4 94810->94812 94866 69039a CreateFileW 94811->94866 94869 67f2c6 20 API calls __dosmaperr 94812->94869 94816 6906b9 94870 67f2d9 20 API calls __dosmaperr 94816->94870 94817 6900f8 94852 690121 LeaveCriticalSection __wsopen_s 94817->94852 94819 690781 GetFileType 94820 69078c GetLastError 94819->94820 94821 6907d3 94819->94821 94873 67f2a3 20 API calls __dosmaperr 94820->94873 94875 68516a 21 API calls 2 library calls 94821->94875 94822 690692 94868 67f2d9 20 API calls __dosmaperr 94822->94868 94823 690756 GetLastError 94872 67f2a3 20 API calls __dosmaperr 94823->94872 94826 690704 94826->94819 94826->94823 94871 69039a CreateFileW 94826->94871 94827 69079a CloseHandle 94827->94822 94829 6907c3 94827->94829 94874 67f2d9 20 API calls __dosmaperr 94829->94874 94831 690749 94831->94819 94831->94823 94833 6907f4 94834 690840 94833->94834 94876 6905ab 72 API calls 3 library calls 94833->94876 94839 69086d 94834->94839 94877 69014d 72 API calls 4 library calls 94834->94877 94835 6907c8 94835->94822 94838 690866 94838->94839 94840 69087e 94838->94840 94841 6886ae __wsopen_s 29 API calls 94839->94841 94840->94817 94842 6908fc CloseHandle 94840->94842 94841->94817 94878 69039a CreateFileW 94842->94878 94844 690927 94845 690931 GetLastError 94844->94845 94846 69095d 94844->94846 94879 67f2a3 20 API calls __dosmaperr 94845->94879 94846->94817 94848 69093d 94880 685333 21 API calls 2 library calls 94848->94880 94850->94797 94851->94803 94852->94803 94854 68522d BuildCatchObjectHelperInternal 94853->94854 94881 682f5e EnterCriticalSection 94854->94881 94856 685234 94857 685259 94856->94857 94862 6852c7 EnterCriticalSection 94856->94862 94864 68527b 94856->94864 94885 685000 94857->94885 94860 6852a4 __wsopen_s 94860->94810 94863 6852d4 LeaveCriticalSection 94862->94863 94862->94864 94863->94856 94882 68532a 94864->94882 94866->94826 94867->94822 94868->94817 94869->94816 94870->94822 94871->94831 94872->94822 94873->94827 94874->94835 94875->94833 94876->94834 94877->94838 94878->94844 94879->94848 94880->94846 94881->94856 94893 682fa6 LeaveCriticalSection 94882->94893 94884 685331 94884->94860 94886 684c7d __dosmaperr 20 API calls 94885->94886 94888 685012 94886->94888 94887 68501f 94889 6829c8 _free 20 API calls 94887->94889 94888->94887 94894 683405 11 API calls 2 library calls 94888->94894 94891 685071 94889->94891 94891->94864 94892 685147 EnterCriticalSection 94891->94892 94892->94864 94893->94884 94894->94888 94895 6a2a00 94910 65d7b0 messages 94895->94910 94896 65db11 PeekMessageW 94896->94910 94897 65d807 GetInputState 94897->94896 94897->94910 94899 6a1cbe TranslateAcceleratorW 94899->94910 94900 65da04 timeGetTime 94900->94910 94901 65db73 TranslateMessage DispatchMessageW 94902 65db8f PeekMessageW 94901->94902 94902->94910 94903 65dbaf Sleep 94919 65dbc0 94903->94919 94904 6a2b74 Sleep 94904->94919 94905 66e551 timeGetTime 94905->94919 94906 6a1dda timeGetTime 95048 66e300 23 API calls 94906->95048 94909 6a2c0b GetExitCodeProcess 94914 6a2c21 WaitForSingleObject 94909->94914 94915 6a2c37 CloseHandle 94909->94915 94910->94896 94910->94897 94910->94899 94910->94900 94910->94901 94910->94902 94910->94903 94910->94904 94910->94906 94913 65d9d5 94910->94913 94927 65dd50 94910->94927 94934 661310 94910->94934 94988 65dfd0 185 API calls 3 library calls 94910->94988 94989 65bf40 94910->94989 95047 66edf6 IsDialogMessageW GetClassLongW 94910->95047 95049 6c3a2a 23 API calls 94910->95049 95050 65ec40 94910->95050 95074 6c359c 82 API calls __wsopen_s 94910->95074 94911 6e29bf GetForegroundWindow 94911->94919 94914->94910 94914->94915 94915->94919 94916 6a2a31 94916->94913 94917 6a2ca9 Sleep 94917->94910 94919->94905 94919->94909 94919->94910 94919->94911 94919->94913 94919->94916 94919->94917 95075 6d5658 23 API calls 94919->95075 95076 6be97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 94919->95076 95077 6bd4dc CreateToolhelp32Snapshot Process32FirstW 94919->95077 94928 65dd83 94927->94928 94929 65dd6f 94927->94929 95119 6c359c 82 API calls __wsopen_s 94928->95119 95087 65d260 94929->95087 94931 65dd7a 94931->94910 94933 6a2f75 94933->94933 94935 661376 94934->94935 94936 6617b0 94934->94936 94938 661390 94935->94938 94939 6a6331 94935->94939 95141 670242 5 API calls __Init_thread_wait 94936->95141 94942 661940 9 API calls 94938->94942 95152 6d709c 185 API calls 94939->95152 94941 6617ba 94944 6617fb 94941->94944 95142 659cb3 94941->95142 94945 6613a0 94942->94945 94943 6a633d 94943->94910 94949 6a6346 94944->94949 94951 66182c 94944->94951 94946 661940 9 API calls 94945->94946 94948 6613b6 94946->94948 94948->94944 94950 6613ec 94948->94950 95153 6c359c 82 API calls __wsopen_s 94949->95153 94950->94949 94974 661408 __fread_nolock 94950->94974 95149 65aceb 23 API calls messages 94951->95149 94954 661839 95150 66d217 185 API calls 94954->95150 94955 6617d4 95148 6701f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 94955->95148 94958 6a636e 95154 6c359c 82 API calls __wsopen_s 94958->95154 94959 66152f 94961 66153c 94959->94961 94962 6a63d1 94959->94962 94964 661940 9 API calls 94961->94964 95156 6d5745 54 API calls _wcslen 94962->95156 94965 661549 94964->94965 94968 6a64fa 94965->94968 94970 661940 9 API calls 94965->94970 94966 66fddb 22 API calls 94966->94974 94967 66fe0b 22 API calls 94967->94974 94978 6a6369 94968->94978 95158 6c359c 82 API calls __wsopen_s 94968->95158 94969 661872 95151 66faeb 23 API calls 94969->95151 94976 661563 94970->94976 94973 65ec40 185 API calls 94973->94974 94974->94954 94974->94958 94974->94959 94974->94966 94974->94967 94974->94973 94975 6a63b2 94974->94975 94974->94978 95155 6c359c 82 API calls __wsopen_s 94975->95155 94976->94968 94981 6615c7 messages 94976->94981 95157 65a8c7 22 API calls __fread_nolock 94976->95157 94978->94910 94980 661940 9 API calls 94980->94981 94981->94968 94981->94969 94981->94978 94981->94980 94983 66167b messages 94981->94983 95127 6dac5b 94981->95127 95130 6da2ea 94981->95130 95135 6c5c5a 94981->95135 94982 66171d 94982->94910 94983->94982 95140 66ce17 22 API calls messages 94983->95140 94988->94910 95223 65adf0 94989->95223 94991 65bf9d 94992 6a04b6 94991->94992 94993 65bfa9 94991->94993 95242 6c359c 82 API calls __wsopen_s 94992->95242 94994 6a04c6 94993->94994 94995 65c01e 94993->94995 95243 6c359c 82 API calls __wsopen_s 94994->95243 95228 65ac91 94995->95228 94999 6b7120 22 API calls 95044 65c039 __fread_nolock messages 94999->95044 95001 65c7da 95005 66fe0b 22 API calls 95001->95005 95002 66fddb 22 API calls 95002->95044 95010 65c808 __fread_nolock 95005->95010 95007 6a04f5 95011 6a055a 95007->95011 95244 66d217 185 API calls 95007->95244 95015 66fe0b 22 API calls 95010->95015 95033 65c603 95011->95033 95245 6c359c 82 API calls __wsopen_s 95011->95245 95012 65ec40 185 API calls 95012->95044 95013 65af8a 22 API calls 95013->95044 95014 6a091a 95255 6c3209 23 API calls 95014->95255 95045 65c350 __fread_nolock messages 95015->95045 95018 6a08a5 95019 65ec40 185 API calls 95018->95019 95021 6a08cf 95019->95021 95021->95033 95253 65a81b 41 API calls 95021->95253 95022 6a0591 95246 6c359c 82 API calls __wsopen_s 95022->95246 95023 6a08f6 95254 6c359c 82 API calls __wsopen_s 95023->95254 95029 65c237 95030 65c253 95029->95030 95256 65a8c7 22 API calls __fread_nolock 95029->95256 95034 6a0976 95030->95034 95038 65c297 messages 95030->95038 95032 66fe0b 22 API calls 95032->95044 95033->94910 95257 65aceb 23 API calls messages 95034->95257 95037 6a09bf 95037->95033 95258 6c359c 82 API calls __wsopen_s 95037->95258 95038->95037 95239 65aceb 23 API calls messages 95038->95239 95040 65c335 95040->95037 95042 65c342 95040->95042 95041 65bbe0 40 API calls 95041->95044 95240 65a704 22 API calls messages 95042->95240 95044->94999 95044->95001 95044->95002 95044->95007 95044->95010 95044->95011 95044->95012 95044->95013 95044->95014 95044->95018 95044->95022 95044->95023 95044->95029 95044->95032 95044->95033 95044->95037 95044->95041 95232 65ad81 95044->95232 95247 6b7099 22 API calls __fread_nolock 95044->95247 95248 6d5745 54 API calls _wcslen 95044->95248 95249 66aa42 22 API calls messages 95044->95249 95250 6bf05c 40 API calls 95044->95250 95251 65a993 41 API calls 95044->95251 95252 65aceb 23 API calls messages 95044->95252 95046 65c3ac 95045->95046 95241 66ce17 22 API calls messages 95045->95241 95046->94910 95047->94910 95048->94910 95049->94910 95071 65ec76 messages 95050->95071 95052 65fef7 95066 65ed9d messages 95052->95066 95271 65a8c7 22 API calls __fread_nolock 95052->95271 95054 66fddb 22 API calls 95054->95071 95055 6a4600 95055->95066 95270 65a8c7 22 API calls __fread_nolock 95055->95270 95056 6a4b0b 95273 6c359c 82 API calls __wsopen_s 95056->95273 95057 65a8c7 22 API calls 95057->95071 95063 670242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95063->95071 95064 65fbe3 95064->95066 95067 6a4bdc 95064->95067 95073 65f3ae messages 95064->95073 95065 65a961 22 API calls 95065->95071 95066->94910 95274 6c359c 82 API calls __wsopen_s 95067->95274 95068 6700a3 29 API calls pre_c_initialization 95068->95071 95070 6a4beb 95275 6c359c 82 API calls __wsopen_s 95070->95275 95071->95052 95071->95054 95071->95055 95071->95056 95071->95057 95071->95063 95071->95064 95071->95065 95071->95066 95071->95068 95071->95070 95072 6701f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 95071->95072 95071->95073 95268 6601e0 185 API calls 2 library calls 95071->95268 95269 6606a0 41 API calls messages 95071->95269 95072->95071 95073->95066 95272 6c359c 82 API calls __wsopen_s 95073->95272 95074->94910 95075->94919 95076->94919 95276 6bdef7 95077->95276 95079 6bd5db FindCloseChangeNotification 95079->94919 95080 6bd529 Process32NextW 95080->95079 95085 6bd522 95080->95085 95081 65a961 22 API calls 95081->95085 95082 659cb3 22 API calls 95082->95085 95085->95079 95085->95080 95085->95081 95085->95082 95282 65525f 22 API calls 95085->95282 95283 656350 22 API calls 95085->95283 95284 66ce60 41 API calls 95085->95284 95088 65ec40 185 API calls 95087->95088 95098 65d29d 95088->95098 95089 6a1bc4 95126 6c359c 82 API calls __wsopen_s 95089->95126 95091 65d30b messages 95091->94931 95092 65d6d5 95092->95091 95103 66fe0b 22 API calls 95092->95103 95093 65d3c3 95093->95092 95095 65d3ce 95093->95095 95094 65d5ff 95096 65d614 95094->95096 95097 6a1bb5 95094->95097 95100 66fddb 22 API calls 95095->95100 95101 66fddb 22 API calls 95096->95101 95125 6d5705 23 API calls 95097->95125 95098->95089 95098->95091 95098->95092 95098->95093 95099 65d4b8 95098->95099 95106 66fddb 22 API calls 95098->95106 95114 65d429 __fread_nolock messages 95098->95114 95104 66fe0b 22 API calls 95099->95104 95109 65d3d5 __fread_nolock 95100->95109 95112 65d46a 95101->95112 95103->95109 95104->95114 95105 66fddb 22 API calls 95107 65d3f6 95105->95107 95106->95098 95107->95114 95120 65bec0 185 API calls 95107->95120 95109->95105 95109->95107 95110 6a1ba4 95124 6c359c 82 API calls __wsopen_s 95110->95124 95112->94931 95114->95094 95114->95110 95114->95112 95115 6a1b7f 95114->95115 95117 6a1b5d 95114->95117 95121 651f6f 185 API calls 95114->95121 95123 6c359c 82 API calls __wsopen_s 95115->95123 95122 6c359c 82 API calls __wsopen_s 95117->95122 95119->94933 95120->95114 95121->95114 95122->95112 95123->95112 95124->95112 95125->95089 95126->95091 95159 6dad64 95127->95159 95129 6dac6f 95129->94981 95131 657510 53 API calls 95130->95131 95132 6da306 95131->95132 95133 6bd4dc 47 API calls 95132->95133 95134 6da315 95133->95134 95134->94981 95136 657510 53 API calls 95135->95136 95137 6c5c6d 95136->95137 95218 6bdbbe lstrlenW 95137->95218 95139 6c5c77 95139->94981 95140->94983 95141->94941 95143 659cc2 _wcslen 95142->95143 95144 66fe0b 22 API calls 95143->95144 95145 659cea __fread_nolock 95144->95145 95146 66fddb 22 API calls 95145->95146 95147 659d00 95146->95147 95147->94955 95148->94944 95149->94954 95150->94969 95151->94969 95152->94943 95153->94978 95154->94978 95155->94978 95156->94976 95157->94981 95158->94978 95160 65a961 22 API calls 95159->95160 95161 6dad77 ___scrt_fastfail 95160->95161 95162 6dadce 95161->95162 95163 657510 53 API calls 95161->95163 95164 6dadee 95162->95164 95167 657510 53 API calls 95162->95167 95166 6dadab 95163->95166 95165 6dae3a 95164->95165 95168 657510 53 API calls 95164->95168 95171 6dae4d ___scrt_fastfail 95165->95171 95213 65b567 39 API calls 95165->95213 95166->95162 95170 657510 53 API calls 95166->95170 95169 6dade4 95167->95169 95178 6dae04 95168->95178 95211 657620 22 API calls _wcslen 95169->95211 95173 6dadc4 95170->95173 95187 657510 95171->95187 95210 657620 22 API calls _wcslen 95173->95210 95178->95165 95180 657510 53 API calls 95178->95180 95179 6daeb0 95183 6daec8 95179->95183 95184 6daf35 GetProcessId 95179->95184 95181 6dae28 95180->95181 95181->95165 95212 65a8c7 22 API calls __fread_nolock 95181->95212 95183->95129 95185 6daf48 95184->95185 95186 6daf58 CloseHandle 95185->95186 95186->95183 95188 657525 95187->95188 95189 657522 ShellExecuteExW 95187->95189 95190 65752d 95188->95190 95191 65755b 95188->95191 95189->95179 95214 6751c6 26 API calls 95190->95214 95193 6950f6 95191->95193 95196 65756d 95191->95196 95201 69500f 95191->95201 95217 675183 26 API calls 95193->95217 95194 65753d 95200 66fddb 22 API calls 95194->95200 95215 66fb21 51 API calls 95196->95215 95197 69510e 95197->95197 95202 657547 95200->95202 95203 695088 95201->95203 95205 66fe0b 22 API calls 95201->95205 95204 659cb3 22 API calls 95202->95204 95216 66fb21 51 API calls 95203->95216 95204->95189 95206 695058 95205->95206 95207 66fddb 22 API calls 95206->95207 95208 69507f 95207->95208 95209 659cb3 22 API calls 95208->95209 95209->95203 95210->95162 95211->95164 95212->95165 95213->95171 95214->95194 95215->95194 95216->95193 95217->95197 95219 6bdbdc GetFileAttributesW 95218->95219 95220 6bdc06 95218->95220 95219->95220 95221 6bdbe8 FindFirstFileW 95219->95221 95220->95139 95221->95220 95222 6bdbf9 FindClose 95221->95222 95222->95220 95224 65ae01 95223->95224 95227 65ae1c messages 95223->95227 95225 65aec9 22 API calls 95224->95225 95226 65ae09 CharUpperBuffW 95225->95226 95226->95227 95227->94991 95229 65acae 95228->95229 95230 65acd1 95229->95230 95259 6c359c 82 API calls __wsopen_s 95229->95259 95230->95044 95233 69fadb 95232->95233 95234 65ad92 95232->95234 95235 66fddb 22 API calls 95234->95235 95236 65ad99 95235->95236 95260 65adcd 95236->95260 95239->95040 95240->95045 95241->95045 95242->94994 95243->95033 95244->95011 95245->95033 95246->95033 95247->95044 95248->95044 95249->95044 95250->95044 95251->95044 95252->95044 95253->95023 95254->95033 95255->95029 95256->95030 95257->95037 95258->95033 95259->95230 95266 65addd 95260->95266 95261 65adb6 95261->95044 95262 66fddb 22 API calls 95262->95266 95263 65a961 22 API calls 95263->95266 95265 65adcd 22 API calls 95265->95266 95266->95261 95266->95262 95266->95263 95266->95265 95267 65a8c7 22 API calls __fread_nolock 95266->95267 95267->95266 95268->95071 95269->95071 95270->95066 95271->95066 95272->95066 95273->95066 95274->95070 95275->95066 95277 6bdf02 95276->95277 95278 6bdf19 95277->95278 95281 6bdf1f 95277->95281 95285 6763b2 GetStringTypeW _strftime 95277->95285 95286 6762fb 39 API calls 95278->95286 95281->95085 95282->95085 95283->95085 95284->95085 95285->95277 95286->95281 95287 692402 95290 651410 95287->95290 95291 6924b8 DestroyWindow 95290->95291 95292 65144f mciSendStringW 95290->95292 95305 6924c4 95291->95305 95293 6516c6 95292->95293 95294 65146b 95292->95294 95293->95294 95296 6516d5 UnregisterHotKey 95293->95296 95295 651479 95294->95295 95294->95305 95323 65182e 95295->95323 95296->95293 95298 692509 95304 69251c FreeLibrary 95298->95304 95306 69252d 95298->95306 95299 6924d8 95299->95305 95329 656246 CloseHandle 95299->95329 95300 6924e2 FindClose 95300->95305 95303 65148e 95303->95306 95311 65149c 95303->95311 95304->95298 95305->95298 95305->95299 95305->95300 95307 692541 VirtualFree 95306->95307 95314 651509 95306->95314 95307->95306 95308 6514f8 OleUninitialize 95308->95314 95309 692589 95316 692598 messages 95309->95316 95330 6c32eb 6 API calls messages 95309->95330 95310 651514 95313 651524 95310->95313 95311->95308 95327 651944 VirtualFreeEx CloseHandle 95313->95327 95314->95309 95314->95310 95319 692627 95316->95319 95331 6b64d4 22 API calls messages 95316->95331 95318 65153a 95318->95316 95320 65161f 95318->95320 95319->95319 95320->95319 95328 651876 CloseHandle InternetCloseHandle InternetCloseHandle WaitForSingleObject 95320->95328 95322 6516c1 95324 65183b 95323->95324 95325 651480 95324->95325 95332 6b702a 22 API calls 95324->95332 95325->95298 95325->95303 95327->95318 95328->95322 95329->95299 95330->95309 95331->95316 95332->95324 95333 692ba5 95334 652b25 95333->95334 95335 692baf 95333->95335 95361 652b83 7 API calls 95334->95361 95379 653a5a 95335->95379 95339 692bb8 95341 659cb3 22 API calls 95339->95341 95343 692bc6 95341->95343 95342 652b2f 95347 652b44 95342->95347 95365 653837 95342->95365 95344 692bce 95343->95344 95345 692bf5 95343->95345 95386 6533c6 95344->95386 95349 6533c6 22 API calls 95345->95349 95353 652b5f 95347->95353 95375 6530f2 95347->95375 95350 692bf1 GetForegroundWindow ShellExecuteW 95349->95350 95355 692c26 95350->95355 95358 652b66 SetCurrentDirectoryW 95353->95358 95355->95353 95357 692be7 95359 6533c6 22 API calls 95357->95359 95360 652b7a 95358->95360 95359->95350 95396 652cd4 7 API calls 95361->95396 95363 652b2a 95364 652c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95363->95364 95364->95342 95366 653862 ___scrt_fastfail 95365->95366 95397 654212 95366->95397 95369 6538e8 95371 653906 Shell_NotifyIconW 95369->95371 95372 693386 Shell_NotifyIconW 95369->95372 95401 653923 95371->95401 95374 65391c 95374->95347 95376 653154 95375->95376 95377 653104 ___scrt_fastfail 95375->95377 95376->95353 95378 653123 Shell_NotifyIconW 95377->95378 95378->95376 95380 691f50 __wsopen_s 95379->95380 95381 653a67 GetModuleFileNameW 95380->95381 95382 659cb3 22 API calls 95381->95382 95383 653a8d 95382->95383 95384 653aa2 23 API calls 95383->95384 95385 653a97 95384->95385 95385->95339 95387 6930bb 95386->95387 95388 6533dd 95386->95388 95390 66fddb 22 API calls 95387->95390 95432 6533ee 95388->95432 95392 6930c5 _wcslen 95390->95392 95391 6533e8 95395 656350 22 API calls 95391->95395 95393 66fe0b 22 API calls 95392->95393 95394 6930fe __fread_nolock 95393->95394 95395->95357 95396->95363 95398 6538b7 95397->95398 95399 6935a4 95397->95399 95398->95369 95423 6bc874 42 API calls _strftime 95398->95423 95399->95398 95400 6935ad DestroyIcon 95399->95400 95400->95398 95402 65393f 95401->95402 95421 653a13 95401->95421 95424 656270 95402->95424 95405 693393 LoadStringW 95408 6933ad 95405->95408 95406 65395a 95407 656b57 22 API calls 95406->95407 95409 65396f 95407->95409 95417 653994 ___scrt_fastfail 95408->95417 95430 65a8c7 22 API calls __fread_nolock 95408->95430 95410 6933c9 95409->95410 95411 65397c 95409->95411 95431 656350 22 API calls 95410->95431 95411->95408 95413 653986 95411->95413 95429 656350 22 API calls 95413->95429 95416 6933d7 95416->95417 95418 6533c6 22 API calls 95416->95418 95419 6539f9 Shell_NotifyIconW 95417->95419 95420 6933f9 95418->95420 95419->95421 95422 6533c6 22 API calls 95420->95422 95421->95374 95422->95417 95423->95369 95425 66fe0b 22 API calls 95424->95425 95426 656295 95425->95426 95427 66fddb 22 API calls 95426->95427 95428 65394d 95427->95428 95428->95405 95428->95406 95429->95417 95430->95417 95431->95416 95433 6533fe _wcslen 95432->95433 95434 69311d 95433->95434 95435 653411 95433->95435 95437 66fddb 22 API calls 95434->95437 95442 65a587 95435->95442 95439 693127 95437->95439 95438 65341e __fread_nolock 95438->95391 95440 66fe0b 22 API calls 95439->95440 95441 693157 __fread_nolock 95440->95441 95443 65a59d 95442->95443 95446 65a598 __fread_nolock 95442->95446 95444 69f80f 95443->95444 95445 66fe0b 22 API calls 95443->95445 95445->95446 95446->95438 95447 652e37 95448 65a961 22 API calls 95447->95448 95449 652e4d 95448->95449 95526 654ae3 95449->95526 95451 652e6b 95452 653a5a 24 API calls 95451->95452 95453 652e7f 95452->95453 95454 659cb3 22 API calls 95453->95454 95455 652e8c 95454->95455 95456 654ecb 94 API calls 95455->95456 95457 652ea5 95456->95457 95458 652ead 95457->95458 95459 692cb0 95457->95459 95540 65a8c7 22 API calls __fread_nolock 95458->95540 95460 6c2cf9 80 API calls 95459->95460 95461 692cc3 95460->95461 95462 692ccf 95461->95462 95464 654f39 68 API calls 95461->95464 95467 654f39 68 API calls 95462->95467 95464->95462 95465 652ec3 95541 656f88 22 API calls 95465->95541 95469 692ce5 95467->95469 95468 652ecf 95470 659cb3 22 API calls 95468->95470 95558 653084 22 API calls 95469->95558 95471 652edc 95470->95471 95542 65a81b 41 API calls 95471->95542 95473 652eec 95476 659cb3 22 API calls 95473->95476 95475 692d02 95559 653084 22 API calls 95475->95559 95478 652f12 95476->95478 95543 65a81b 41 API calls 95478->95543 95479 692d1e 95481 653a5a 24 API calls 95479->95481 95482 692d44 95481->95482 95560 653084 22 API calls 95482->95560 95483 652f21 95486 65a961 22 API calls 95483->95486 95485 692d50 95561 65a8c7 22 API calls __fread_nolock 95485->95561 95488 652f3f 95486->95488 95544 653084 22 API calls 95488->95544 95489 692d5e 95562 653084 22 API calls 95489->95562 95492 652f4b 95545 674a28 40 API calls 3 library calls 95492->95545 95494 692d6d 95563 65a8c7 22 API calls __fread_nolock 95494->95563 95495 652f59 95495->95469 95496 652f63 95495->95496 95546 674a28 40 API calls 3 library calls 95496->95546 95499 652f6e 95499->95475 95502 652f78 95499->95502 95500 692d83 95564 653084 22 API calls 95500->95564 95547 674a28 40 API calls 3 library calls 95502->95547 95503 692d90 95505 652f83 95505->95479 95506 652f8d 95505->95506 95548 674a28 40 API calls 3 library calls 95506->95548 95508 652f98 95509 652fdc 95508->95509 95549 653084 22 API calls 95508->95549 95509->95494 95510 652fe8 95509->95510 95510->95503 95552 6563eb 22 API calls 95510->95552 95513 652fbf 95550 65a8c7 22 API calls __fread_nolock 95513->95550 95515 652ff8 95553 656a50 22 API calls 95515->95553 95516 652fcd 95551 653084 22 API calls 95516->95551 95519 653006 95554 6570b0 23 API calls 95519->95554 95523 653021 95524 653065 95523->95524 95555 656f88 22 API calls 95523->95555 95556 6570b0 23 API calls 95523->95556 95557 653084 22 API calls 95523->95557 95527 654af0 __wsopen_s 95526->95527 95528 656b57 22 API calls 95527->95528 95529 654b22 95527->95529 95528->95529 95538 654b58 95529->95538 95565 654c6d 95529->95565 95531 659cb3 22 API calls 95533 654c52 95531->95533 95532 659cb3 22 API calls 95532->95538 95534 65515f 22 API calls 95533->95534 95537 654c5e 95534->95537 95535 654c6d 22 API calls 95535->95538 95536 65515f 22 API calls 95536->95538 95537->95451 95538->95532 95538->95535 95538->95536 95539 654c29 95538->95539 95539->95531 95539->95537 95540->95465 95541->95468 95542->95473 95543->95483 95544->95492 95545->95495 95546->95499 95547->95505 95548->95508 95549->95513 95550->95516 95551->95509 95552->95515 95553->95519 95554->95523 95555->95523 95556->95523 95557->95523 95558->95475 95559->95479 95560->95485 95561->95489 95562->95494 95563->95500 95564->95503 95566 65aec9 22 API calls 95565->95566 95567 654c78 95566->95567 95567->95529 95568 653156 95571 653170 95568->95571 95572 653187 95571->95572 95573 6531e9 95572->95573 95574 65318c 95572->95574 95575 6531eb 95572->95575 95576 6531d0 DefWindowProcW 95573->95576 95579 653265 PostQuitMessage 95574->95579 95580 653199 95574->95580 95577 692dfb 95575->95577 95578 6531f1 95575->95578 95583 65316a 95576->95583 95619 6518e2 10 API calls 95577->95619 95584 65321d SetTimer RegisterWindowMessageW 95578->95584 95585 6531f8 95578->95585 95579->95583 95581 6531a4 95580->95581 95582 692e7c 95580->95582 95588 692e68 95581->95588 95589 6531ae 95581->95589 95623 6bbf30 34 API calls ___scrt_fastfail 95582->95623 95584->95583 95590 653246 CreatePopupMenu 95584->95590 95592 653201 KillTimer 95585->95592 95593 692d9c 95585->95593 95587 692e1c 95620 66e499 42 API calls 95587->95620 95622 6bc161 27 API calls ___scrt_fastfail 95588->95622 95595 692e4d 95589->95595 95596 6531b9 95589->95596 95590->95583 95600 6530f2 Shell_NotifyIconW 95592->95600 95598 692da1 95593->95598 95599 692dd7 MoveWindow 95593->95599 95595->95576 95621 6b0ad7 22 API calls 95595->95621 95603 6531c4 95596->95603 95604 653253 95596->95604 95597 692e8e 95597->95576 95597->95583 95605 692da7 95598->95605 95606 692dc6 SetFocus 95598->95606 95599->95583 95607 653214 95600->95607 95602 653263 95602->95583 95603->95576 95613 6530f2 Shell_NotifyIconW 95603->95613 95617 65326f 44 API calls ___scrt_fastfail 95604->95617 95605->95603 95609 692db0 95605->95609 95606->95583 95616 653c50 DeleteObject DestroyWindow 95607->95616 95618 6518e2 10 API calls 95609->95618 95614 692e41 95613->95614 95615 653837 49 API calls 95614->95615 95615->95573 95616->95583 95617->95602 95618->95583 95619->95587 95620->95603 95621->95573 95622->95602 95623->95597 95624 651033 95629 654c91 95624->95629 95628 651042 95630 65a961 22 API calls 95629->95630 95631 654cff 95630->95631 95637 653af0 95631->95637 95634 654d9c 95635 651038 95634->95635 95640 6551f7 22 API calls __fread_nolock 95634->95640 95636 6700a3 29 API calls __onexit 95635->95636 95636->95628 95641 653b1c 95637->95641 95640->95634 95642 653b0f 95641->95642 95643 653b29 95641->95643 95642->95634 95643->95642 95644 653b30 RegOpenKeyExW 95643->95644 95644->95642 95645 653b4a RegQueryValueExW 95644->95645 95646 653b80 RegCloseKey 95645->95646 95647 653b6b 95645->95647 95646->95642 95647->95646 95648 65f7bf 95649 65fcb6 95648->95649 95650 65f7d3 95648->95650 95685 65aceb 23 API calls messages 95649->95685 95652 65fcc2 95650->95652 95653 66fddb 22 API calls 95650->95653 95686 65aceb 23 API calls messages 95652->95686 95655 65f7e5 95653->95655 95655->95652 95656 65f83e 95655->95656 95657 65fd3d 95655->95657 95659 661310 185 API calls 95656->95659 95663 65ed9d messages 95656->95663 95687 6c1155 22 API calls 95657->95687 95666 65ec76 messages 95659->95666 95660 6a4beb 95693 6c359c 82 API calls __wsopen_s 95660->95693 95662 65fef7 95662->95663 95689 65a8c7 22 API calls __fread_nolock 95662->95689 95665 65f3ae messages 95665->95663 95690 6c359c 82 API calls __wsopen_s 95665->95690 95666->95660 95666->95662 95666->95663 95666->95665 95667 6a4600 95666->95667 95668 6a4b0b 95666->95668 95674 65a8c7 22 API calls 95666->95674 95675 65fbe3 95666->95675 95676 65a961 22 API calls 95666->95676 95679 670242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95666->95679 95680 6701f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 95666->95680 95681 6700a3 29 API calls pre_c_initialization 95666->95681 95682 66fddb 22 API calls 95666->95682 95683 6601e0 185 API calls 2 library calls 95666->95683 95684 6606a0 41 API calls messages 95666->95684 95667->95663 95688 65a8c7 22 API calls __fread_nolock 95667->95688 95691 6c359c 82 API calls __wsopen_s 95668->95691 95674->95666 95675->95663 95675->95665 95677 6a4bdc 95675->95677 95676->95666 95692 6c359c 82 API calls __wsopen_s 95677->95692 95679->95666 95680->95666 95681->95666 95682->95666 95683->95666 95684->95666 95685->95652 95686->95657 95687->95663 95688->95663 95689->95663 95690->95663 95691->95663 95692->95660 95693->95663 95694 6703fb 95695 670407 BuildCatchObjectHelperInternal 95694->95695 95723 66feb1 95695->95723 95697 670561 95753 67083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 95697->95753 95699 67040e 95699->95697 95701 670438 95699->95701 95700 670568 95746 674e52 95700->95746 95712 670477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 95701->95712 95734 68247d 95701->95734 95708 670457 95710 6704d8 95742 670959 95710->95742 95712->95710 95749 674e1a 38 API calls 3 library calls 95712->95749 95714 6704de 95715 6704f3 95714->95715 95750 670992 GetModuleHandleW 95715->95750 95717 6704fa 95717->95700 95718 6704fe 95717->95718 95719 670507 95718->95719 95751 674df5 28 API calls _abort 95718->95751 95752 670040 13 API calls 2 library calls 95719->95752 95722 67050f 95722->95708 95724 66feba 95723->95724 95755 670698 IsProcessorFeaturePresent 95724->95755 95726 66fec6 95756 672c94 10 API calls 3 library calls 95726->95756 95728 66fecb 95733 66fecf 95728->95733 95757 682317 95728->95757 95730 66fee6 95730->95699 95733->95699 95736 682494 95734->95736 95735 670a8c CatchGuardHandler 5 API calls 95737 670451 95735->95737 95736->95735 95737->95708 95738 682421 95737->95738 95739 682450 95738->95739 95740 670a8c CatchGuardHandler 5 API calls 95739->95740 95741 682479 95740->95741 95741->95712 95808 672340 95742->95808 95744 67096c GetStartupInfoW 95745 67097f 95744->95745 95745->95714 95810 674bcf 95746->95810 95749->95710 95750->95717 95751->95719 95752->95722 95753->95700 95755->95726 95756->95728 95761 68d1f6 95757->95761 95760 672cbd 8 API calls 3 library calls 95760->95733 95764 68d213 95761->95764 95765 68d20f 95761->95765 95763 66fed8 95763->95730 95763->95760 95764->95765 95767 684bfb 95764->95767 95779 670a8c 95765->95779 95768 684c07 BuildCatchObjectHelperInternal 95767->95768 95786 682f5e EnterCriticalSection 95768->95786 95770 684c0e 95787 6850af 95770->95787 95772 684c1d 95773 684c2c 95772->95773 95800 684a8f 29 API calls 95772->95800 95802 684c48 LeaveCriticalSection _abort 95773->95802 95776 684c27 95801 684b45 GetStdHandle GetFileType 95776->95801 95778 684c3d __wsopen_s 95778->95764 95780 670a97 IsProcessorFeaturePresent 95779->95780 95781 670a95 95779->95781 95783 670c5d 95780->95783 95781->95763 95807 670c21 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 95783->95807 95785 670d40 95785->95763 95786->95770 95788 6850bb BuildCatchObjectHelperInternal 95787->95788 95789 6850c8 95788->95789 95790 6850df 95788->95790 95804 67f2d9 20 API calls __dosmaperr 95789->95804 95803 682f5e EnterCriticalSection 95790->95803 95793 6850cd 95805 6827ec 26 API calls pre_c_initialization 95793->95805 95796 6850d7 __wsopen_s 95796->95772 95797 685000 __wsopen_s 21 API calls 95798 6850eb 95797->95798 95798->95797 95799 685117 95798->95799 95806 68513e LeaveCriticalSection _abort 95799->95806 95800->95776 95801->95773 95802->95778 95803->95798 95804->95793 95805->95796 95806->95796 95807->95785 95809 672357 95808->95809 95809->95744 95809->95809 95811 674bdb _unexpected 95810->95811 95812 674bf4 95811->95812 95813 674be2 95811->95813 95834 682f5e EnterCriticalSection 95812->95834 95849 674d29 GetModuleHandleW 95813->95849 95816 674be7 95816->95812 95850 674d6d GetModuleHandleExW 95816->95850 95817 674c99 95838 674cd9 95817->95838 95822 674c70 95824 674c88 95822->95824 95829 682421 _abort 5 API calls 95822->95829 95823 674bfb 95823->95817 95823->95822 95835 6821a8 95823->95835 95830 682421 _abort 5 API calls 95824->95830 95825 674cb6 95841 674ce8 95825->95841 95826 674ce2 95858 691d29 5 API calls CatchGuardHandler 95826->95858 95829->95824 95830->95817 95834->95823 95859 681ee1 95835->95859 95878 682fa6 LeaveCriticalSection 95838->95878 95840 674cb2 95840->95825 95840->95826 95879 68360c 95841->95879 95844 674d16 95847 674d6d _abort 8 API calls 95844->95847 95845 674cf6 GetPEB 95845->95844 95846 674d06 GetCurrentProcess TerminateProcess 95845->95846 95846->95844 95848 674d1e ExitProcess 95847->95848 95849->95816 95851 674d97 GetProcAddress 95850->95851 95852 674dba 95850->95852 95853 674dac 95851->95853 95854 674dc0 FreeLibrary 95852->95854 95855 674dc9 95852->95855 95853->95852 95854->95855 95856 670a8c CatchGuardHandler 5 API calls 95855->95856 95857 674bf3 95856->95857 95857->95812 95862 681e90 95859->95862 95861 681f05 95861->95822 95863 681e9c BuildCatchObjectHelperInternal 95862->95863 95870 682f5e EnterCriticalSection 95863->95870 95865 681eaa 95871 681f31 95865->95871 95869 681ec8 __wsopen_s 95869->95861 95870->95865 95874 681f59 95871->95874 95875 681f51 95871->95875 95872 670a8c CatchGuardHandler 5 API calls 95873 681eb7 95872->95873 95877 681ed5 LeaveCriticalSection _abort 95873->95877 95874->95875 95876 6829c8 _free 20 API calls 95874->95876 95875->95872 95876->95875 95877->95869 95878->95840 95880 683631 95879->95880 95881 683627 95879->95881 95886 682fd7 5 API calls 2 library calls 95880->95886 95883 670a8c CatchGuardHandler 5 API calls 95881->95883 95885 674cf2 95883->95885 95884 683648 95884->95881 95885->95844 95885->95845 95886->95884 95887 651098 95892 6542de 95887->95892 95891 6510a7 95893 65a961 22 API calls 95892->95893 95894 6542f5 GetVersionExW 95893->95894 95895 656b57 22 API calls 95894->95895 95896 654342 95895->95896 95897 6593b2 22 API calls 95896->95897 95900 654378 95896->95900 95898 65436c 95897->95898 95899 6537a0 22 API calls 95898->95899 95899->95900 95901 65441b GetCurrentProcess IsWow64Process 95900->95901 95908 6937df 95900->95908 95902 654437 95901->95902 95903 65444f LoadLibraryA 95902->95903 95904 693824 GetSystemInfo 95902->95904 95905 654460 GetProcAddress 95903->95905 95906 65449c GetSystemInfo 95903->95906 95905->95906 95909 654470 GetNativeSystemInfo 95905->95909 95907 654476 95906->95907 95910 65109d 95907->95910 95911 65447a FreeLibrary 95907->95911 95909->95907 95912 6700a3 29 API calls __onexit 95910->95912 95911->95910 95912->95891 95913 65105b 95918 65344d 95913->95918 95915 65106a 95949 6700a3 29 API calls __onexit 95915->95949 95917 651074 95919 65345d __wsopen_s 95918->95919 95920 65a961 22 API calls 95919->95920 95921 653513 95920->95921 95922 653a5a 24 API calls 95921->95922 95923 65351c 95922->95923 95950 653357 95923->95950 95926 6533c6 22 API calls 95927 653535 95926->95927 95928 65515f 22 API calls 95927->95928 95929 653544 95928->95929 95930 65a961 22 API calls 95929->95930 95931 65354d 95930->95931 95932 65a6c3 22 API calls 95931->95932 95933 653556 RegOpenKeyExW 95932->95933 95934 693176 RegQueryValueExW 95933->95934 95939 653578 95933->95939 95935 69320c RegCloseKey 95934->95935 95936 693193 95934->95936 95935->95939 95948 69321e _wcslen 95935->95948 95937 66fe0b 22 API calls 95936->95937 95938 6931ac 95937->95938 95941 655722 22 API calls 95938->95941 95939->95915 95940 654c6d 22 API calls 95940->95948 95942 6931b7 RegQueryValueExW 95941->95942 95943 6931d4 95942->95943 95945 6931ee messages 95942->95945 95944 656b57 22 API calls 95943->95944 95944->95945 95945->95935 95946 659cb3 22 API calls 95946->95948 95947 65515f 22 API calls 95947->95948 95948->95939 95948->95940 95948->95946 95948->95947 95949->95917 95951 691f50 __wsopen_s 95950->95951 95952 653364 GetFullPathNameW 95951->95952 95953 653386 95952->95953 95954 656b57 22 API calls 95953->95954 95955 6533a4 95954->95955 95955->95926 95956 6a3f75 95967 66ceb1 95956->95967 95958 6a3f8b 95960 6a4006 95958->95960 95976 66e300 23 API calls 95958->95976 95961 65bf40 185 API calls 95960->95961 95962 6a4052 95961->95962 95965 6a4a88 95962->95965 95978 6c359c 82 API calls __wsopen_s 95962->95978 95964 6a3fe6 95964->95962 95977 6c1abf 22 API calls 95964->95977 95968 66ced2 95967->95968 95969 66cebf 95967->95969 95971 66ced7 95968->95971 95972 66cf05 95968->95972 95979 65aceb 23 API calls messages 95969->95979 95973 66fddb 22 API calls 95971->95973 95980 65aceb 23 API calls messages 95972->95980 95975 66cec9 95973->95975 95975->95958 95976->95964 95977->95960 95978->95965 95979->95975 95980->95975

                                                                                    Executed Functions

                                                                                    Function 006542DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 234 6542de-65434d call 65a961 GetVersionExW call 656b57 239 654353 234->239 240 693617-69362a 234->240 242 654355-654357 239->242 241 69362b-69362f 240->241 243 693631 241->243 244 693632-69363e 241->244 245 65435d-6543bc call 6593b2 call 6537a0 242->245 246 693656 242->246 243->244 244->241 247 693640-693642 244->247 262 6937df-6937e6 245->262 263 6543c2-6543c4 245->263 250 69365d-693660 246->250 247->242 249 693648-69364f 247->249 249->240 253 693651 249->253 254 65441b-654435 GetCurrentProcess IsWow64Process 250->254 255 693666-6936a8 250->255 253->246 257 654494-65449a 254->257 258 654437 254->258 255->254 259 6936ae-6936b1 255->259 264 65443d-654449 257->264 258->264 260 6936db-6936e5 259->260 261 6936b3-6936bd 259->261 268 6936f8-693702 260->268 269 6936e7-6936f3 260->269 265 6936ca-6936d6 261->265 266 6936bf-6936c5 261->266 270 6937e8 262->270 271 693806-693809 262->271 263->250 267 6543ca-6543dd 263->267 272 65444f-65445e LoadLibraryA 264->272 273 693824-693828 GetSystemInfo 264->273 265->254 266->254 274 6543e3-6543e5 267->274 275 693726-69372f 267->275 277 693715-693721 268->277 278 693704-693710 268->278 269->254 276 6937ee 270->276 279 69380b-69381a 271->279 280 6937f4-6937fc 271->280 281 654460-65446e GetProcAddress 272->281 282 65449c-6544a6 GetSystemInfo 272->282 284 69374d-693762 274->284 285 6543eb-6543ee 274->285 286 69373c-693748 275->286 287 693731-693737 275->287 276->280 277->254 278->254 279->276 288 69381c-693822 279->288 280->271 281->282 289 654470-654474 GetNativeSystemInfo 281->289 283 654476-654478 282->283 294 654481-654493 283->294 295 65447a-65447b FreeLibrary 283->295 292 69376f-69377b 284->292 293 693764-69376a 284->293 290 6543f4-65440f 285->290 291 693791-693794 285->291 286->254 287->254 288->280 289->283 297 654415 290->297 298 693780-69378c 290->298 291->254 296 69379a-6937c1 291->296 292->254 293->254 295->294 299 6937ce-6937da 296->299 300 6937c3-6937c9 296->300 297->254 298->254 299->254 300->254
                                                                                    APIs
                                                                                    • GetVersionExW.KERNEL32(?), ref: 0065430D
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                    • GetCurrentProcess.KERNEL32(?,006ECB64,00000000,?,?), ref: 00654422
                                                                                    • IsWow64Process.KERNEL32(00000000,?,?), ref: 00654429
                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00654454
                                                                                    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00654466
                                                                                    • GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00654474
                                                                                    • FreeLibrary.KERNEL32(00000000,?,?), ref: 0065447B
                                                                                    • GetSystemInfo.KERNEL32(?,?,?), ref: 006544A0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                                                    • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                                                    • API String ID: 3290436268-3101561225
                                                                                    • Opcode ID: 78a360105b7f4e953348578ee2cec67ae59cd18518c1da8aa695ce887d434785
                                                                                    • Instruction ID: d1229db66bd635ffbc9a381eb4b08ff54e23e51ed6654f6bec55a727f9c94828
                                                                                    • Opcode Fuzzy Hash: 78a360105b7f4e953348578ee2cec67ae59cd18518c1da8aa695ce887d434785
                                                                                    • Instruction Fuzzy Hash: 35A1917290A3D0CFCB31CB6978841D57FEBBB76305B84D899D44197B23D628464BCB29
                                                                                    Function 006542A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 638 6542a2-6542ba CreateStreamOnHGlobal 639 6542bc-6542d3 FindResourceExW 638->639 640 6542da-6542dd 638->640 641 6935ba-6935c9 LoadResource 639->641 642 6542d9 639->642 641->642 643 6935cf-6935dd SizeofResource 641->643 642->640 643->642 644 6935e3-6935ee LockResource 643->644 644->642 645 6935f4-693612 644->645 645->642
                                                                                    APIs
                                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,006550AA,?,?,00000000,00000000), ref: 006542B2
                                                                                    • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006550AA,?,?,00000000,00000000), ref: 006542C9
                                                                                    • LoadResource.KERNEL32(?,00000000,?,?,006550AA,?,?,00000000,00000000,?,?,?,?,?,?,00654F20), ref: 006935BE
                                                                                    • SizeofResource.KERNEL32(?,00000000,?,?,006550AA,?,?,00000000,00000000,?,?,?,?,?,?,00654F20), ref: 006935D3
                                                                                    • LockResource.KERNEL32(006550AA,?,?,006550AA,?,?,00000000,00000000,?,?,?,?,?,?,00654F20,?), ref: 006935E6
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                                    • String ID: SCRIPT
                                                                                    • API String ID: 3051347437-3967369404
                                                                                    • Opcode ID: fce59e238b42b5a2df6009cf6409ea0874b37e850f5b3004a5a4fff83ede3820
                                                                                    • Instruction ID: f9769746bb7edcce0e66cb8646505d8c36efaf626eb467f897af93ce7943ec36
                                                                                    • Opcode Fuzzy Hash: fce59e238b42b5a2df6009cf6409ea0874b37e850f5b3004a5a4fff83ede3820
                                                                                    • Instruction Fuzzy Hash: 7511AC70200701BFDB218B65DC88F677BBAEFC5B66F1041A9F9028A290DB71D9068620
                                                                                    Function 00692BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00652B6B
                                                                                      • Part of subcall function 00653A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00721418,?,00652E7F,?,?,?,00000000), ref: 00653A78
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • GetForegroundWindow.USER32(runas,?,?,?,?,?,00712224), ref: 00692C10
                                                                                    • ShellExecuteW.SHELL32(00000000,?,?,00712224), ref: 00692C17
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                                                                                    • String ID: runas
                                                                                    • API String ID: 448630720-4000483414
                                                                                    • Opcode ID: 5dbe033e093d2c3b895021daa648fd0e2df0bce3e92545c48fe1801090830f9e
                                                                                    • Instruction ID: 41900bf2992666ef1c4b79e904dbd03b4992c0c215cca727da251fba4263bf26
                                                                                    • Opcode Fuzzy Hash: 5dbe033e093d2c3b895021daa648fd0e2df0bce3e92545c48fe1801090830f9e
                                                                                    • Instruction Fuzzy Hash: 23110A31204396AAC758FF24D8619FE77A7AFA1756F44142CF886021A3DF24964EC716
                                                                                    Function 006BD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1153 6bd4dc-6bd524 CreateToolhelp32Snapshot Process32FirstW call 6bdef7 1156 6bd5d2-6bd5d5 1153->1156 1157 6bd5db-6bd5ea FindCloseChangeNotification 1156->1157 1158 6bd529-6bd538 Process32NextW 1156->1158 1158->1157 1159 6bd53e-6bd5ad call 65a961 * 2 call 659cb3 call 65525f call 65988f call 656350 call 66ce60 1158->1159 1174 6bd5af-6bd5b1 1159->1174 1175 6bd5b7-6bd5be 1159->1175 1176 6bd5c0-6bd5cd call 65988f * 2 1174->1176 1177 6bd5b3-6bd5b5 1174->1177 1175->1176 1176->1156 1177->1175 1177->1176
                                                                                    APIs
                                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 006BD501
                                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 006BD50F
                                                                                    • Process32NextW.KERNEL32(00000000,?), ref: 006BD52F
                                                                                    • FindCloseChangeNotification.KERNEL32(00000000), ref: 006BD5DC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
                                                                                    • String ID:
                                                                                    • API String ID: 3243318325-0
                                                                                    • Opcode ID: 533268f2dc367ee78c05785ecf2e3d21b5ad8bccc8c168062810969dc2bbd827
                                                                                    • Instruction ID: 88d7afa7943415d84b48853c1e322b8b78fb2e98028e15f6ff69cde392d02ca7
                                                                                    • Opcode Fuzzy Hash: 533268f2dc367ee78c05785ecf2e3d21b5ad8bccc8c168062810969dc2bbd827
                                                                                    • Instruction Fuzzy Hash: 3031BB721083409FD314DF54C885AEF7BF9EF95354F14092DF581871A1EB719949C7A2
                                                                                    Function 006BDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1181 6bdbbe-6bdbda lstrlenW 1182 6bdbdc-6bdbe6 GetFileAttributesW 1181->1182 1183 6bdc06 1181->1183 1184 6bdc09-6bdc0d 1182->1184 1185 6bdbe8-6bdbf7 FindFirstFileW 1182->1185 1183->1184 1185->1183 1186 6bdbf9-6bdc04 FindClose 1185->1186 1186->1184
                                                                                    APIs
                                                                                    • lstrlenW.KERNEL32(?,00695222), ref: 006BDBCE
                                                                                    • GetFileAttributesW.KERNEL32(?), ref: 006BDBDD
                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 006BDBEE
                                                                                    • FindClose.KERNEL32(00000000), ref: 006BDBFA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FileFind$AttributesCloseFirstlstrlen
                                                                                    • String ID:
                                                                                    • API String ID: 2695905019-0
                                                                                    • Opcode ID: 7c7a436d471d2ab47c8993413a23828cb5d9d5877ac619fd0acc54f8a3afe699
                                                                                    • Instruction ID: 536eb0267a568534381475238b03268e265374d4cb72334f6e2c1e5718fc8147
                                                                                    • Opcode Fuzzy Hash: 7c7a436d471d2ab47c8993413a23828cb5d9d5877ac619fd0acc54f8a3afe699
                                                                                    • Instruction Fuzzy Hash: 7FF0A0B0810A105BC3206B78AC4E8EA3B6E9E01374B104702F936CA2E0FBB05E968695
                                                                                    Function 00674CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentProcess.KERNEL32(006828E9,?,00674CBE,006828E9,007188B8,0000000C,00674E15,006828E9,00000002,00000000,?,006828E9), ref: 00674D09
                                                                                    • TerminateProcess.KERNEL32(00000000,?,00674CBE,006828E9,007188B8,0000000C,00674E15,006828E9,00000002,00000000,?,006828E9), ref: 00674D10
                                                                                    • ExitProcess.KERNEL32 ref: 00674D22
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process$CurrentExitTerminate
                                                                                    • String ID:
                                                                                    • API String ID: 1703294689-0
                                                                                    • Opcode ID: ae9e7d59c947b49ff3fc1afb108902cfdff5fd279ed2539a2ac11bc6f60e7b9f
                                                                                    • Instruction ID: 2ee145f00dc133f455b4b57a6956f04ab40719a04766007d5578301c8770aa1e
                                                                                    • Opcode Fuzzy Hash: ae9e7d59c947b49ff3fc1afb108902cfdff5fd279ed2539a2ac11bc6f60e7b9f
                                                                                    • Instruction Fuzzy Hash: 90E0B631000688AFCF21AF54DD5DA983B6BEF41791B118018FC599A222DF35ED52CB84
                                                                                    Function 0065BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: BuffCharUpper
                                                                                    • String ID: p#r
                                                                                    • API String ID: 3964851224-2870138419
                                                                                    • Opcode ID: 449f0e8b3a7933033ea64ff978b61be1dbdf4440735bb24963ce52f7b068eddc
                                                                                    • Instruction ID: 02cdfdeb09e58ab69f27963b5ba3ac8e3f4e597750935dfc31e0ee941e8f42ad
                                                                                    • Opcode Fuzzy Hash: 449f0e8b3a7933033ea64ff978b61be1dbdf4440735bb24963ce52f7b068eddc
                                                                                    • Instruction Fuzzy Hash: 46A26A70A083019FD750DF18C480B6ABBE2BF89314F14896DE99A9B352D771ED49CF92
                                                                                    Function 0065D730 Relevance: 21.6, APIs: 14, Instructions: 624windowsleeptimeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetInputState.USER32 ref: 0065D807
                                                                                    • timeGetTime.WINMM ref: 0065DA07
                                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0065DB28
                                                                                    • TranslateMessage.USER32(?), ref: 0065DB7B
                                                                                    • DispatchMessageW.USER32(?), ref: 0065DB89
                                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0065DB9F
                                                                                    • Sleep.KERNEL32(0000000A), ref: 0065DBB1
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                                                                    • String ID:
                                                                                    • API String ID: 2189390790-0
                                                                                    • Opcode ID: 216055a9f5a21205266e4274c0e0fcd2adc9e5abfe6c4dc084e05778d00dd206
                                                                                    • Instruction ID: 7977ddb8226260600a7b1aabcae716ddc6900fe612610d7984770880b4ec29b5
                                                                                    • Opcode Fuzzy Hash: 216055a9f5a21205266e4274c0e0fcd2adc9e5abfe6c4dc084e05778d00dd206
                                                                                    • Instruction Fuzzy Hash: 2A42ED70648342AFD738DB28C894BAAB7A3BF46315F14851DE8568B3D1D770E849CF92
                                                                                    Function 00652CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 00652D07
                                                                                    • RegisterClassExW.USER32(00000030), ref: 00652D31
                                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00652D42
                                                                                    • InitCommonControlsEx.COMCTL32(?), ref: 00652D5F
                                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00652D6F
                                                                                    • LoadIconW.USER32(000000A9), ref: 00652D85
                                                                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00652D94
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                    • API String ID: 2914291525-1005189915
                                                                                    • Opcode ID: dae08b6424e42e31e8a010173d708220186e22e785f40eeafdd4aa9225f3184e
                                                                                    • Instruction ID: 0e892ea2933e2b93f2e2b3f4331e3d69494aac59b8ae1d2ac942cecc70a94ef4
                                                                                    • Opcode Fuzzy Hash: dae08b6424e42e31e8a010173d708220186e22e785f40eeafdd4aa9225f3184e
                                                                                    • Instruction Fuzzy Hash: BB21F4B1D01388AFDB10DFA4EC89BDDBBB5FB08710F00811AF951AA2A0D7B51582CF95
                                                                                    Function 0069065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 302 69065b-69068b call 69042f 305 69068d-690698 call 67f2c6 302->305 306 6906a6-6906b2 call 685221 302->306 313 69069a-6906a1 call 67f2d9 305->313 311 6906cb-690714 call 69039a 306->311 312 6906b4-6906c9 call 67f2c6 call 67f2d9 306->312 321 690781-69078a GetFileType 311->321 322 690716-69071f 311->322 312->313 323 69097d-690983 313->323 324 69078c-6907bd GetLastError call 67f2a3 CloseHandle 321->324 325 6907d3-6907d6 321->325 327 690721-690725 322->327 328 690756-69077c GetLastError call 67f2a3 322->328 324->313 339 6907c3-6907ce call 67f2d9 324->339 331 6907d8-6907dd 325->331 332 6907df-6907e5 325->332 327->328 333 690727-690754 call 69039a 327->333 328->313 336 6907e9-690837 call 68516a 331->336 332->336 337 6907e7 332->337 333->321 333->328 344 690839-690845 call 6905ab 336->344 345 690847-69086b call 69014d 336->345 337->336 339->313 344->345 351 69086f-690879 call 6886ae 344->351 352 69086d 345->352 353 69087e-6908c1 345->353 351->323 352->351 355 6908c3-6908c7 353->355 356 6908e2-6908f0 353->356 355->356 358 6908c9-6908dd 355->358 359 69097b 356->359 360 6908f6-6908fa 356->360 358->356 359->323 360->359 361 6908fc-69092f CloseHandle call 69039a 360->361 364 690931-69095d GetLastError call 67f2a3 call 685333 361->364 365 690963-690977 361->365 364->365 365->359
                                                                                    APIs
                                                                                      • Part of subcall function 0069039A: CreateFileW.KERNEL32(00000000,00000000,?,00690704,?,?,00000000,?,00690704,00000000,0000000C), ref: 006903B7
                                                                                    • GetLastError.KERNEL32 ref: 0069076F
                                                                                    • __dosmaperr.LIBCMT ref: 00690776
                                                                                    • GetFileType.KERNEL32(00000000), ref: 00690782
                                                                                    • GetLastError.KERNEL32 ref: 0069078C
                                                                                    • __dosmaperr.LIBCMT ref: 00690795
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006907B5
                                                                                    • CloseHandle.KERNEL32(?), ref: 006908FF
                                                                                    • GetLastError.KERNEL32 ref: 00690931
                                                                                    • __dosmaperr.LIBCMT ref: 00690938
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                    • String ID: H
                                                                                    • API String ID: 4237864984-2852464175
                                                                                    • Opcode ID: 1793a960a0c088c8825cc3fd0a2471f501f1ac3879cb398db04b09a4ea6dc8dd
                                                                                    • Instruction ID: 61be8149191f8781fc8cd08766da8d2541b88e9c317c32a72f21fe91be01d7c3
                                                                                    • Opcode Fuzzy Hash: 1793a960a0c088c8825cc3fd0a2471f501f1ac3879cb398db04b09a4ea6dc8dd
                                                                                    • Instruction Fuzzy Hash: 78A13732A001448FEF19EFA8D891BAE3BA6AB06320F14415DF8159F392DB359D13CB95
                                                                                    Function 0065344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                      • Part of subcall function 00653A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00721418,?,00652E7F,?,?,?,00000000), ref: 00653A78
                                                                                      • Part of subcall function 00653357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00653379
                                                                                    • RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0065356A
                                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0069318D
                                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 006931CE
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 00693210
                                                                                    • _wcslen.LIBCMT ref: 00693277
                                                                                    • _wcslen.LIBCMT ref: 00693286
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                                                    • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                                    • API String ID: 98802146-2727554177
                                                                                    • Opcode ID: f111b981b935bcc1e4305b57c27feab92acf407287686b9bd664972aaa9a6622
                                                                                    • Instruction ID: b6f9038dfe77727cd765c739aafd6c1ed179e7780dd37c9cdf6caa18552a8770
                                                                                    • Opcode Fuzzy Hash: f111b981b935bcc1e4305b57c27feab92acf407287686b9bd664972aaa9a6622
                                                                                    • Instruction Fuzzy Hash: 7071B471404311AEC764DF69DC818ABBBE9FF84750F40482DF94583272EB34DA4ACB69
                                                                                    Function 00652B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 00652B8E
                                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 00652B9D
                                                                                    • LoadIconW.USER32(00000063), ref: 00652BB3
                                                                                    • LoadIconW.USER32(000000A4), ref: 00652BC5
                                                                                    • LoadIconW.USER32(000000A2), ref: 00652BD7
                                                                                    • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00652BEF
                                                                                    • RegisterClassExW.USER32(?), ref: 00652C40
                                                                                      • Part of subcall function 00652CD4: GetSysColorBrush.USER32(0000000F), ref: 00652D07
                                                                                      • Part of subcall function 00652CD4: RegisterClassExW.USER32(00000030), ref: 00652D31
                                                                                      • Part of subcall function 00652CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00652D42
                                                                                      • Part of subcall function 00652CD4: InitCommonControlsEx.COMCTL32(?), ref: 00652D5F
                                                                                      • Part of subcall function 00652CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00652D6F
                                                                                      • Part of subcall function 00652CD4: LoadIconW.USER32(000000A9), ref: 00652D85
                                                                                      • Part of subcall function 00652CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00652D94
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                    • String ID: #$0$AutoIt v3
                                                                                    • API String ID: 423443420-4155596026
                                                                                    • Opcode ID: 63f634f8345902c878ead149d5ee6251ff4b8c5a76a7bc53d7a86c4faed7a235
                                                                                    • Instruction ID: 783d483d010fc9a0bb01303295a4ab1fad87e89fdce480fc40ac6c879138e26d
                                                                                    • Opcode Fuzzy Hash: 63f634f8345902c878ead149d5ee6251ff4b8c5a76a7bc53d7a86c4faed7a235
                                                                                    • Instruction Fuzzy Hash: 1A212F70E00354ABDB20DFA5EC99A9D7FB6FB5CB50F40802AE500A66A1D7B90542CF98
                                                                                    Function 00653170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 443 653170-653185 444 6531e5-6531e7 443->444 445 653187-65318a 443->445 444->445 446 6531e9 444->446 447 65318c-653193 445->447 448 6531eb 445->448 449 6531d0-6531d8 DefWindowProcW 446->449 452 653265-65326d PostQuitMessage 447->452 453 653199-65319e 447->453 450 692dfb-692e23 call 6518e2 call 66e499 448->450 451 6531f1-6531f6 448->451 456 6531de-6531e4 449->456 486 692e28-692e2f 450->486 458 65321d-653244 SetTimer RegisterWindowMessageW 451->458 459 6531f8-6531fb 451->459 457 653219-65321b 452->457 454 6531a4-6531a8 453->454 455 692e7c-692e90 call 6bbf30 453->455 462 692e68-692e77 call 6bc161 454->462 463 6531ae-6531b3 454->463 455->457 480 692e96 455->480 457->456 458->457 464 653246-653251 CreatePopupMenu 458->464 466 653201-65320f KillTimer call 6530f2 459->466 467 692d9c-692d9f 459->467 462->457 469 692e4d-692e54 463->469 470 6531b9-6531be 463->470 464->457 484 653214 call 653c50 466->484 472 692da1-692da5 467->472 473 692dd7-692df6 MoveWindow 467->473 469->449 483 692e5a-692e63 call 6b0ad7 469->483 478 6531c4-6531ca 470->478 479 653253-653263 call 65326f 470->479 481 692da7-692daa 472->481 482 692dc6-692dd2 SetFocus 472->482 473->457 478->449 478->486 479->457 480->449 481->478 487 692db0-692dc1 call 6518e2 481->487 482->457 483->449 484->457 486->449 491 692e35-692e48 call 6530f2 call 653837 486->491 487->457 491->449
                                                                                    APIs
                                                                                    • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0065316A,?,?), ref: 006531D8
                                                                                    • KillTimer.USER32(?,00000001,?,?,?,?,?,0065316A,?,?), ref: 00653204
                                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00653227
                                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0065316A,?,?), ref: 00653232
                                                                                    • CreatePopupMenu.USER32 ref: 00653246
                                                                                    • PostQuitMessage.USER32(00000000), ref: 00653267
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                    • String ID: TaskbarCreated
                                                                                    • API String ID: 129472671-2362178303
                                                                                    • Opcode ID: c21653bf14e05ea2750db710be114565370aff5c76a3a8c7c3cac0fdf6eb385a
                                                                                    • Instruction ID: b2e0193ca8c4c6342d9392ee841b1043713f5ca121fb9add3406ca8af45fa62b
                                                                                    • Opcode Fuzzy Hash: c21653bf14e05ea2750db710be114565370aff5c76a3a8c7c3cac0fdf6eb385a
                                                                                    • Instruction Fuzzy Hash: E4418A30200660A7DF345B389C59BB93A1FFB01BC2F444129FD0186792CB759B4A8769
                                                                                    Function 00651410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 499 651410-651449 500 6924b8-6924b9 DestroyWindow 499->500 501 65144f-651465 mciSendStringW 499->501 504 6924c4-6924d1 500->504 502 6516c6-6516d3 501->502 503 65146b-651473 501->503 506 6516d5-6516f0 UnregisterHotKey 502->506 507 6516f8-6516ff 502->507 503->504 505 651479-651488 call 65182e 503->505 509 692500-692507 504->509 510 6924d3-6924d6 504->510 520 69250e-69251a 505->520 521 65148e-651496 505->521 506->507 512 6516f2-6516f3 call 6510d0 506->512 507->503 508 651705 507->508 508->502 509->504 513 692509 509->513 514 6924d8-6924e0 call 656246 510->514 515 6924e2-6924e5 FindClose 510->515 512->507 513->520 519 6924eb-6924f8 514->519 515->519 519->509 525 6924fa-6924fb call 6c32b1 519->525 522 69251c-69251e FreeLibrary 520->522 523 692524-69252b 520->523 526 65149c-6514c1 call 65cfa0 521->526 527 692532-69253f 521->527 522->523 523->520 530 69252d 523->530 525->509 536 6514c3 526->536 537 6514f8-651503 OleUninitialize 526->537 531 692541-69255e VirtualFree 527->531 532 692566-69256d 527->532 530->527 531->532 534 692560-692561 call 6c3317 531->534 532->527 535 69256f 532->535 534->532 539 692574-692578 535->539 540 6514c6-6514f6 call 651a05 call 6519ae 536->540 537->539 541 651509-65150e 537->541 539->541 542 69257e-692584 539->542 540->537 544 692589-692596 call 6c32eb 541->544 545 651514-65151e 541->545 542->541 557 692598 544->557 548 651524-6515a5 call 65988f call 651944 call 6517d5 call 66fe14 call 65177c call 65988f call 65cfa0 call 6517fe call 66fe14 545->548 549 651707-651714 call 66f80e 545->549 561 69259d-6925bf call 66fdcd 548->561 589 6515ab-6515cf call 66fe14 548->589 549->548 559 65171a 549->559 557->561 559->549 568 6925c1 561->568 571 6925c6-6925e8 call 66fdcd 568->571 576 6925ea 571->576 579 6925ef-692611 call 66fdcd 576->579 585 692613 579->585 588 692618-692625 call 6b64d4 585->588 595 692627 588->595 589->571 594 6515d5-6515f9 call 66fe14 589->594 594->579 599 6515ff-651619 call 66fe14 594->599 598 69262c-692639 call 66ac64 595->598 603 69263b 598->603 599->588 605 65161f-651643 call 6517d5 call 66fe14 599->605 606 692640-69264d call 6c3245 603->606 605->598 614 651649-651651 605->614 612 69264f 606->612 615 692654-692661 call 6c32cc 612->615 614->606 616 651657-651675 call 65988f call 65190a 614->616 622 692663 615->622 616->615 624 65167b-651689 616->624 625 692668-692675 call 6c32cc 622->625 624->625 626 65168f-6516c5 call 65988f * 3 call 651876 624->626 631 692677 625->631 631->631
                                                                                    APIs
                                                                                    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00651459
                                                                                    • OleUninitialize.OLE32(?,00000000), ref: 006514F8
                                                                                    • UnregisterHotKey.USER32(?), ref: 006516DD
                                                                                    • DestroyWindow.USER32(?), ref: 006924B9
                                                                                    • FreeLibrary.KERNEL32(?), ref: 0069251E
                                                                                    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0069254B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                                    • String ID: close all
                                                                                    • API String ID: 469580280-3243417748
                                                                                    • Opcode ID: 28302b2a248759d5f0cf854ea8fe37e4e31a26f4d903f04660c2624afdd4c9f2
                                                                                    • Instruction ID: 28c34b492536f24f359584fb1bae0c7815e34c048c74b945109e4133d1577069
                                                                                    • Opcode Fuzzy Hash: 28302b2a248759d5f0cf854ea8fe37e4e31a26f4d903f04660c2624afdd4c9f2
                                                                                    • Instruction Fuzzy Hash: 5BD199307022129FCB19EF14C8A8B68F7A6BF05711F1141ADE84A6B652CB30AD17CF54
                                                                                    Function 00652C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 648 652c63-652cd3 CreateWindowExW * 2 ShowWindow * 2
                                                                                    APIs
                                                                                    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00652C91
                                                                                    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00652CB2
                                                                                    • ShowWindow.USER32(00000000,?,?,?,?,?,?,00651CAD,?), ref: 00652CC6
                                                                                    • ShowWindow.USER32(00000000,?,?,?,?,?,?,00651CAD,?), ref: 00652CCF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$CreateShow
                                                                                    • String ID: AutoIt v3$edit
                                                                                    • API String ID: 1584632944-3779509399
                                                                                    • Opcode ID: 1c20f2be02cdbd0b90e4c4cafd8d5f062fd96cf1cba39e44dba258b83739478a
                                                                                    • Instruction ID: 1509880fc33566b40d0e0048bd747752c72185296fb345744600f98fd590af85
                                                                                    • Opcode Fuzzy Hash: 1c20f2be02cdbd0b90e4c4cafd8d5f062fd96cf1cba39e44dba258b83739478a
                                                                                    • Instruction Fuzzy Hash: E9F030755413D47AEB3047136C58E772E7FE7DAF60F414029F90097561C2790842DA74
                                                                                    Function 006DAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 763 6dad64-6dad9c call 65a961 call 672340 768 6dad9e-6dadb5 call 657510 763->768 769 6dadd1-6dadd5 763->769 768->769 778 6dadb7-6dadce call 657510 call 657620 768->778 771 6dadd7-6dadee call 657510 call 657620 769->771 772 6dadf1-6dadf5 769->772 771->772 773 6dae3a 772->773 774 6dadf7-6dae0e call 657510 772->774 779 6dae3c-6dae40 773->779 774->779 787 6dae10-6dae21 call 659b47 774->787 778->769 783 6dae53-6daeae call 672340 call 657510 ShellExecuteExW 779->783 784 6dae42-6dae50 call 65b567 779->784 800 6daeb7-6daeb9 783->800 801 6daeb0-6daeb6 call 66fe14 783->801 784->783 787->773 799 6dae23-6dae2e call 657510 787->799 799->773 808 6dae30-6dae35 call 65a8c7 799->808 805 6daebb-6daec1 call 66fe14 800->805 806 6daec2-6daec6 800->806 801->800 805->806 810 6daec8-6daed6 806->810 811 6daf0a-6daf0e 806->811 808->773 816 6daed8 810->816 817 6daedb-6daeeb 810->817 812 6daf1b-6daf33 call 65cfa0 811->812 813 6daf10-6daf19 811->813 820 6daf6d-6daf7b call 65988f 812->820 827 6daf35-6daf46 GetProcessId 812->827 813->820 816->817 818 6daeed 817->818 819 6daef0-6daf08 call 65cfa0 817->819 818->819 819->820 828 6daf4e-6daf67 call 65cfa0 CloseHandle 827->828 829 6daf48 827->829 828->820 829->828
                                                                                    APIs
                                                                                    • ShellExecuteExW.SHELL32(0000003C), ref: 006DAEA3
                                                                                      • Part of subcall function 00657620: _wcslen.LIBCMT ref: 00657625
                                                                                    • GetProcessId.KERNEL32(00000000), ref: 006DAF38
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006DAF67
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CloseExecuteHandleProcessShell_wcslen
                                                                                    • String ID: <$@
                                                                                    • API String ID: 146682121-1426351568
                                                                                    • Opcode ID: b703e5fa9e5d9236c1a9794c34b32919848bd0d84dcea500383b1f8400f9b4d0
                                                                                    • Instruction ID: 9044f712f0e868f21f0840df1ecbe58480cfc55c978469578142c149d318bcd1
                                                                                    • Opcode Fuzzy Hash: b703e5fa9e5d9236c1a9794c34b32919848bd0d84dcea500383b1f8400f9b4d0
                                                                                    • Instruction Fuzzy Hash: 1F716671A04219DFCB14DF94D484A9EBBF2BF08310F04849EE856AB3A2DB74ED45CB95
                                                                                    Function 00653B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1142 653b1c-653b27 1143 653b99-653b9b 1142->1143 1144 653b29-653b2e 1142->1144 1146 653b8c-653b8f 1143->1146 1144->1143 1145 653b30-653b48 RegOpenKeyExW 1144->1145 1145->1143 1147 653b4a-653b69 RegQueryValueExW 1145->1147 1148 653b80-653b8b RegCloseKey 1147->1148 1149 653b6b-653b76 1147->1149 1148->1146 1150 653b90-653b97 1149->1150 1151 653b78-653b7a 1149->1151 1152 653b7e 1150->1152 1151->1152 1152->1148
                                                                                    APIs
                                                                                    • RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00653B0F,SwapMouseButtons,00000004,?), ref: 00653B40
                                                                                    • RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00653B0F,SwapMouseButtons,00000004,?), ref: 00653B61
                                                                                    • RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00653B0F,SwapMouseButtons,00000004,?), ref: 00653B83
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID: Control Panel\Mouse
                                                                                    • API String ID: 3677997916-824357125
                                                                                    • Opcode ID: 907bc2682818df922bd664a387d7361281f9316733459ff2e75c622d38d161f2
                                                                                    • Instruction ID: bfe2c28518de5ff4789866d10faaa5e8bd943de483b7927bf5a9c0bc9ebe3a03
                                                                                    • Opcode Fuzzy Hash: 907bc2682818df922bd664a387d7361281f9316733459ff2e75c622d38d161f2
                                                                                    • Instruction Fuzzy Hash: D6112AB5510228FFDB20CFA5DC84AEEB7B9EF24B95F104459F805D7210D2319F499760
                                                                                    Function 00653923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 006933A2
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                    • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00653A04
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: IconLoadNotifyShell_String_wcslen
                                                                                    • String ID: Line:
                                                                                    • API String ID: 2289894680-1585850449
                                                                                    • Opcode ID: 7afb4bf88d1cc87138735b64e11f4705e67cc82242a4c30013d730299802f4d8
                                                                                    • Instruction ID: 09443a0868a8819de0f64ffd3e2ea0bf9cc63d204c6efb2a44c8ca5606384701
                                                                                    • Opcode Fuzzy Hash: 7afb4bf88d1cc87138735b64e11f4705e67cc82242a4c30013d730299802f4d8
                                                                                    • Instruction Fuzzy Hash: 633135B1408324AEC720EB10DC45BEB73DAAF50751F00492EF99983291EB74964DC7CA
                                                                                    Function 00652DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetOpenFileNameW.COMDLG32(?), ref: 00692C8C
                                                                                      • Part of subcall function 00653AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00653A97,?,?,00652E7F,?,?,?,00000000), ref: 00653AC2
                                                                                      • Part of subcall function 00652DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00652DC4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Name$Path$FileFullLongOpen
                                                                                    • String ID: X$`eq
                                                                                    • API String ID: 779396738-2521718294
                                                                                    • Opcode ID: 5eea4695bbcb712421c7cf0afe6b0978c6269b011984b357348e6a2486a37af3
                                                                                    • Instruction ID: 983a35442e7b49877046eb6310b34380cc1eb036ede0f771b276c1b577e21da1
                                                                                    • Opcode Fuzzy Hash: 5eea4695bbcb712421c7cf0afe6b0978c6269b011984b357348e6a2486a37af3
                                                                                    • Instruction Fuzzy Hash: D721C671A002989FDF41DF94C8457EE7BFEAF49315F00805DE805AB241DBB8568DCB65
                                                                                    Function 0066FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00670668
                                                                                      • Part of subcall function 006732A4: RaiseException.KERNEL32(?,?,?,0067068A,?,00721444,?,?,?,?,?,?,0067068A,00651129,00718738,00651129), ref: 00673304
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00670685
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Exception@8Throw$ExceptionRaise
                                                                                    • String ID: Unknown exception
                                                                                    • API String ID: 3476068407-410509341
                                                                                    • Opcode ID: c0cff6e7d71d13b0338497acf44c0de78cc8e26b0679e2d76922b145892babeb
                                                                                    • Instruction ID: 8899e42144b4caede2df655531f9ac538a49a02422e7d31342e0ec7c05099c52
                                                                                    • Opcode Fuzzy Hash: c0cff6e7d71d13b0338497acf44c0de78cc8e26b0679e2d76922b145892babeb
                                                                                    • Instruction Fuzzy Hash: 07F0C83490020DB7DB40B764E856CDE7B6F5E40350B60C139B82C956D2EF71EB65C995
                                                                                    Function 006510F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00651BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00651BF4
                                                                                      • Part of subcall function 00651BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00651BFC
                                                                                      • Part of subcall function 00651BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00651C07
                                                                                      • Part of subcall function 00651BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00651C12
                                                                                      • Part of subcall function 00651BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00651C1A
                                                                                      • Part of subcall function 00651BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00651C22
                                                                                      • Part of subcall function 00651B4A: RegisterWindowMessageW.USER32(00000004,?,006512C4), ref: 00651BA2
                                                                                    • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0065136A
                                                                                    • OleInitialize.OLE32 ref: 00651388
                                                                                    • CloseHandle.KERNEL32(00000000,00000000), ref: 006924AB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                                    • String ID:
                                                                                    • API String ID: 1986988660-0
                                                                                    • Opcode ID: 8c786d37e164ce23198904f3e3bdadea70f531c65ca683e02792bf889fc2c2f9
                                                                                    • Instruction ID: 1d2263b783836e5a4b9491bb4e5b66f266908f8d4b7dfa5e82b79d82a66b772d
                                                                                    • Opcode Fuzzy Hash: 8c786d37e164ce23198904f3e3bdadea70f531c65ca683e02792bf889fc2c2f9
                                                                                    • Instruction Fuzzy Hash: 8971CDB48113848EC7A4EF7AA8856553AE2FBA9350794C2BED41AC7361EB384517CF4C
                                                                                    Function 006886AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,006885CC,?,00718CC8,0000000C), ref: 00688704
                                                                                    • GetLastError.KERNEL32(?,006885CC,?,00718CC8,0000000C), ref: 0068870E
                                                                                    • __dosmaperr.LIBCMT ref: 00688739
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ChangeCloseErrorFindLastNotification__dosmaperr
                                                                                    • String ID:
                                                                                    • API String ID: 490808831-0
                                                                                    • Opcode ID: d5c134127179d2cd3cc0bb4cc8ab802801079b77e6987ef06b4afe5ce1718900
                                                                                    • Instruction ID: 512f680dffe422c70b9d41c06c27de5eeef2bd5594787abc22dd94d15fa47bce
                                                                                    • Opcode Fuzzy Hash: d5c134127179d2cd3cc0bb4cc8ab802801079b77e6987ef06b4afe5ce1718900
                                                                                    • Instruction Fuzzy Hash: 0C016632A046602FC6B07334A845BBE275B4B82774F78031DF8198B2D3FEA09CC28394
                                                                                    Function 00661310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __Init_thread_footer.LIBCMT ref: 006617F6
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Init_thread_footer
                                                                                    • String ID: CALL
                                                                                    • API String ID: 1385522511-4196123274
                                                                                    • Opcode ID: 5a20459b555e54183998b9417f2572805602e47501efbc3f9befe2bc5a76bbd2
                                                                                    • Instruction ID: f4fdb87fb3bf7881a837351de71db10a786f6ef5ee60640852ff05c3874bcec8
                                                                                    • Opcode Fuzzy Hash: 5a20459b555e54183998b9417f2572805602e47501efbc3f9befe2bc5a76bbd2
                                                                                    • Instruction Fuzzy Hash: 322279B06082419FC754DF14C480A6ABBF2BF8A314F18895DF4968B362D771ED46CB96
                                                                                    Function 00653837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00653908
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: IconNotifyShell_
                                                                                    • String ID:
                                                                                    • API String ID: 1144537725-0
                                                                                    • Opcode ID: 7bd57cb03348205f3e7089ad035d8eeef39627dd44c53bb20aa5f964fe7d4c33
                                                                                    • Instruction ID: bde5487bc9b110165cd73c1087169afb1ba45195ae026ff73014243caebaca8f
                                                                                    • Opcode Fuzzy Hash: 7bd57cb03348205f3e7089ad035d8eeef39627dd44c53bb20aa5f964fe7d4c33
                                                                                    • Instruction Fuzzy Hash: D231DDB06043118FD721DF24C8847D7BBEAFB48759F00082EF99A87381E771AA48CB56
                                                                                    Function 00654ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00654E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00654EDD,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654E9C
                                                                                      • Part of subcall function 00654E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00654EAE
                                                                                      • Part of subcall function 00654E90: FreeLibrary.KERNEL32(00000000,?,?,00654EDD,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654EC0
                                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654EFD
                                                                                      • Part of subcall function 00654E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00693CDE,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654E62
                                                                                      • Part of subcall function 00654E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00654E74
                                                                                      • Part of subcall function 00654E59: FreeLibrary.KERNEL32(00000000,?,?,00693CDE,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654E87
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Library$Load$AddressFreeProc
                                                                                    • String ID:
                                                                                    • API String ID: 2632591731-0
                                                                                    • Opcode ID: 8c380032dc1582e75bcfb175eb22353c9112b0a7dac4d1cc1dabc7f7d9aee887
                                                                                    • Instruction ID: 8cfea4965fd7627bf3c7fd85242d37b6e5836b65d16e051762006636d18ff633
                                                                                    • Opcode Fuzzy Hash: 8c380032dc1582e75bcfb175eb22353c9112b0a7dac4d1cc1dabc7f7d9aee887
                                                                                    • Instruction Fuzzy Hash: 25112731600305ABCF20AB64DC13FED77A79F80716F10846DF942AA2C1DE719A899B58
                                                                                    Function 00688402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: __wsopen_s
                                                                                    • String ID:
                                                                                    • API String ID: 3347428461-0
                                                                                    • Opcode ID: 34fe8b4899aeca4906800a0d652637d339b80dd1cd2d8cfd07b205ba3f8d7ee6
                                                                                    • Instruction ID: 7cb5516d7d9e6bb6c651fa09d866eb454ba8ab5a125e510057c21e358af687ec
                                                                                    • Opcode Fuzzy Hash: 34fe8b4899aeca4906800a0d652637d339b80dd1cd2d8cfd07b205ba3f8d7ee6
                                                                                    • Instruction Fuzzy Hash: 6B11187690410AAFCF15DF58E9459DA7BF9EF48314F104159FC08AB312DB31DA11CBA5
                                                                                    Function 00685000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00684C7D: RtlAllocateHeap.NTDLL(00000008,00651129,00000000,?,00682E29,00000001,00000364,?,?,?,0067F2DE,00683863,00721444,?,0066FDF5,?), ref: 00684CBE
                                                                                    • _free.LIBCMT ref: 0068506C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap_free
                                                                                    • String ID:
                                                                                    • API String ID: 614378929-0
                                                                                    • Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                                    • Instruction ID: e9001b339ea05cd7597037358b083ecdc6ce5ed09acf64951df07bb0b7c8b5e3
                                                                                    • Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                                    • Instruction Fuzzy Hash: D30149722047056BE3319F69D881A9AFBEEFB89370F25071DE185832C0EA30A805C7B4
                                                                                    Function 0067E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                                    • Instruction ID: ce59425beb689528b2b3a0803b6e269519891e65598e675e3c1cec6942fc88aa
                                                                                    • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                                    • Instruction Fuzzy Hash: D4F02D32510A109AC7313A658C05B96339F9F56331F10875DF429932D2DF75D40687AD
                                                                                    Function 00684C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RtlAllocateHeap.NTDLL(00000008,00651129,00000000,?,00682E29,00000001,00000364,?,?,?,0067F2DE,00683863,00721444,?,0066FDF5,?), ref: 00684CBE
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 1279760036-0
                                                                                    • Opcode ID: 6f5834232dc2b2d7b7115c9b3cd561a30314433b9d632661b160d27c9b682eb2
                                                                                    • Instruction ID: 4e66fade5ec09ac97d8ed61349ee3a4715805f1d0a2b0c1a75379742fcbe8485
                                                                                    • Opcode Fuzzy Hash: 6f5834232dc2b2d7b7115c9b3cd561a30314433b9d632661b160d27c9b682eb2
                                                                                    • Instruction Fuzzy Hash: A1F0E93160232667DB217F629C09F9A778FBF417B0B148315F819AA381CF30D80147E4
                                                                                    Function 00683820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RtlAllocateHeap.NTDLL(00000000,?,00721444,?,0066FDF5,?,?,0065A976,00000010,00721440,006513FC,?,006513C6,?,00651129), ref: 00683852
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 1279760036-0
                                                                                    • Opcode ID: 9d3bfa437fb6d7bac5e435e2f448e5153ee96fcd75765b3ea1cb25a76605aa2a
                                                                                    • Instruction ID: e57252ac323efe4cf35a316f952d116ae403dceea70ea8c40a7e0e39a7499a1a
                                                                                    • Opcode Fuzzy Hash: 9d3bfa437fb6d7bac5e435e2f448e5153ee96fcd75765b3ea1cb25a76605aa2a
                                                                                    • Instruction Fuzzy Hash: C8E0657120123457D73137669C05BDA375BAF42FB0F154225BD19A6791DF21DE0283E5
                                                                                    Function 00654F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FreeLibrary.KERNEL32(?,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654F6D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FreeLibrary
                                                                                    • String ID:
                                                                                    • API String ID: 3664257935-0
                                                                                    • Opcode ID: 97665c2f31d41196d5938b8b35b48ab73077dcafb01d07f46b0c63f46e6d5501
                                                                                    • Instruction ID: bb447280d2e05777c6d42886680fd2d30f26418ad2caeae4b7c91520adf8f7a6
                                                                                    • Opcode Fuzzy Hash: 97665c2f31d41196d5938b8b35b48ab73077dcafb01d07f46b0c63f46e6d5501
                                                                                    • Instruction Fuzzy Hash: B9F03071105751CFDB349F68D490892B7F6AF5432E720C9BEE5DA86611CB319888DF10
                                                                                    Function 006530F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • Shell_NotifyIconW.SHELL32(00000002,?), ref: 0065314E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: IconNotifyShell_
                                                                                    • String ID:
                                                                                    • API String ID: 1144537725-0
                                                                                    • Opcode ID: 2c368481132045fabd7fc83f841c19fc761c87bd689f0fe5e17bf99b0a125ca7
                                                                                    • Instruction ID: e580839b1ec8f6790889bda27aa7d3d08cb059c1c1b7e28af6b26a8ab7a15db6
                                                                                    • Opcode Fuzzy Hash: 2c368481132045fabd7fc83f841c19fc761c87bd689f0fe5e17bf99b0a125ca7
                                                                                    • Instruction Fuzzy Hash: 7FF0A0709003589FEB62DB24DC4A7DA7BFDBB01708F0040E9A68896282DB744B89CF49
                                                                                    Function 00652DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00652DC4
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: LongNamePath_wcslen
                                                                                    • String ID:
                                                                                    • API String ID: 541455249-0
                                                                                    • Opcode ID: 3296704a66b7fad363819037c5ec3ece6009363ce7c61283e5975a316511eb8a
                                                                                    • Instruction ID: 6f6724d3d812cfaec9662fe2ac5accb29db9f2a77b7f9d2a72e17cea6609aa0b
                                                                                    • Opcode Fuzzy Hash: 3296704a66b7fad363819037c5ec3ece6009363ce7c61283e5975a316511eb8a
                                                                                    • Instruction Fuzzy Hash: 41E0CD726002245BCB109258DC06FEA77DEDFC9790F044075FD09D7248E970AD84C554
                                                                                    Function 00652B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00653837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00653908
                                                                                      • Part of subcall function 0065D730: GetInputState.USER32 ref: 0065D807
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00652B6B
                                                                                      • Part of subcall function 006530F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0065314E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: IconNotifyShell_$CurrentDirectoryInputState
                                                                                    • String ID:
                                                                                    • API String ID: 3667716007-0
                                                                                    • Opcode ID: 14aa4f2f446f745a369b6f2ae99b729c1d0a5fe962c2d4539497771aca698d3f
                                                                                    • Instruction ID: 7111602fcebae8006b3cee7cbfcc01de4248b4b353fb619188c6b85b8ee6c701
                                                                                    • Opcode Fuzzy Hash: 14aa4f2f446f745a369b6f2ae99b729c1d0a5fe962c2d4539497771aca698d3f
                                                                                    • Instruction Fuzzy Hash: E1E0262230039406C648BB30A8524ADA75B9BE1793F80193EF846832A3CE24454E8219
                                                                                    Function 0069039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,00000000,?,00690704,?,?,00000000,?,00690704,00000000,0000000C), ref: 006903B7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateFile
                                                                                    • String ID:
                                                                                    • API String ID: 823142352-0
                                                                                    • Opcode ID: aca095a7001605555c303e2941296a5305b67fc124bae2dcb2e608b777a3f51e
                                                                                    • Instruction ID: ae6bcf3653203c91a21b78b9659ac26365f5240972e12a901b948c67c24d61c3
                                                                                    • Opcode Fuzzy Hash: aca095a7001605555c303e2941296a5305b67fc124bae2dcb2e608b777a3f51e
                                                                                    • Instruction Fuzzy Hash: 4ED06C3204024DBBDF028F84DD46EDA3FAAFB48714F014000BE1856020C732E822AB91
                                                                                    Function 00651CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00651CBC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: InfoParametersSystem
                                                                                    • String ID:
                                                                                    • API String ID: 3098949447-0
                                                                                    • Opcode ID: 47e506b50181b68d6dd6a3dd142f6c81153a22e48075472ce671746b7eb42e2d
                                                                                    • Instruction ID: 24ebb36ed78e265add8f37f47326ed41ed5d1524bbe73ca82e3902bbbe7bbae0
                                                                                    • Opcode Fuzzy Hash: 47e506b50181b68d6dd6a3dd142f6c81153a22e48075472ce671746b7eb42e2d
                                                                                    • Instruction Fuzzy Hash: 8FC09B35280344BFF3248780BC5AF107755B35CB10F54C001F609595E3C3A55432D654

                                                                                    Non-executed Functions

                                                                                    Function 006E9576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00669BB2
                                                                                    • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 006E961A
                                                                                    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006E965B
                                                                                    • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 006E969F
                                                                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006E96C9
                                                                                    • SendMessageW.USER32 ref: 006E96F2
                                                                                    • GetKeyState.USER32(00000011), ref: 006E978B
                                                                                    • GetKeyState.USER32(00000009), ref: 006E9798
                                                                                    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006E97AE
                                                                                    • GetKeyState.USER32(00000010), ref: 006E97B8
                                                                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006E97E9
                                                                                    • SendMessageW.USER32 ref: 006E9810
                                                                                    • SendMessageW.USER32(?,00001030,?,006E7E95), ref: 006E9918
                                                                                    • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 006E992E
                                                                                    • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 006E9941
                                                                                    • SetCapture.USER32(?), ref: 006E994A
                                                                                    • ClientToScreen.USER32(?,?), ref: 006E99AF
                                                                                    • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 006E99BC
                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006E99D6
                                                                                    • ReleaseCapture.USER32 ref: 006E99E1
                                                                                    • GetCursorPos.USER32(?), ref: 006E9A19
                                                                                    • ScreenToClient.USER32(?,?), ref: 006E9A26
                                                                                    • SendMessageW.USER32(?,00001012,00000000,?), ref: 006E9A80
                                                                                    • SendMessageW.USER32 ref: 006E9AAE
                                                                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 006E9AEB
                                                                                    • SendMessageW.USER32 ref: 006E9B1A
                                                                                    • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 006E9B3B
                                                                                    • SendMessageW.USER32(?,0000110B,00000009,?), ref: 006E9B4A
                                                                                    • GetCursorPos.USER32(?), ref: 006E9B68
                                                                                    • ScreenToClient.USER32(?,?), ref: 006E9B75
                                                                                    • GetParent.USER32(?), ref: 006E9B93
                                                                                    • SendMessageW.USER32(?,00001012,00000000,?), ref: 006E9BFA
                                                                                    • SendMessageW.USER32 ref: 006E9C2B
                                                                                    • ClientToScreen.USER32(?,?), ref: 006E9C84
                                                                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 006E9CB4
                                                                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 006E9CDE
                                                                                    • SendMessageW.USER32 ref: 006E9D01
                                                                                    • ClientToScreen.USER32(?,?), ref: 006E9D4E
                                                                                    • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 006E9D82
                                                                                      • Part of subcall function 00669944: GetWindowLongW.USER32(?,000000EB), ref: 00669952
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E9E05
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                                                    • String ID: @GUI_DRAGID$F$p#r
                                                                                    • API String ID: 3429851547-1426232733
                                                                                    • Opcode ID: 088ff62231dd88897168e2340455309fed83f1472120c805eb0633a6af840eb8
                                                                                    • Instruction ID: 59efd8f7bad7d6fd94ea9ab98a92cca95d4942506c068969b08063b1088a1931
                                                                                    • Opcode Fuzzy Hash: 088ff62231dd88897168e2340455309fed83f1472120c805eb0633a6af840eb8
                                                                                    • Instruction Fuzzy Hash: 05427F34105381AFDB24CF25CC84AAABBF6FF49720F14461AFA99872A1D731AC55CF61
                                                                                    Function 006E4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 006E48F3
                                                                                    • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 006E4908
                                                                                    • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 006E4927
                                                                                    • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 006E494B
                                                                                    • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 006E495C
                                                                                    • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 006E497B
                                                                                    • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 006E49AE
                                                                                    • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 006E49D4
                                                                                    • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 006E4A0F
                                                                                    • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 006E4A56
                                                                                    • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 006E4A7E
                                                                                    • IsMenu.USER32(?), ref: 006E4A97
                                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006E4AF2
                                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006E4B20
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E4B94
                                                                                    • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 006E4BE3
                                                                                    • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 006E4C82
                                                                                    • wsprintfW.USER32 ref: 006E4CAE
                                                                                    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 006E4CC9
                                                                                    • GetWindowTextW.USER32(?,00000000,00000001), ref: 006E4CF1
                                                                                    • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 006E4D13
                                                                                    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 006E4D33
                                                                                    • GetWindowTextW.USER32(?,00000000,00000001), ref: 006E4D5A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                                                                    • String ID: %d/%02d/%02d
                                                                                    • API String ID: 4054740463-328681919
                                                                                    • Opcode ID: 9b35b9cabf1d2ce4d5de85496a149a76a85ebfc042d099489b985c44b2ebe2ae
                                                                                    • Instruction ID: b82878b59713ad524887e61069f2d9a2722be30d2c77e8eefc3b977cc4f54094
                                                                                    • Opcode Fuzzy Hash: 9b35b9cabf1d2ce4d5de85496a149a76a85ebfc042d099489b985c44b2ebe2ae
                                                                                    • Instruction Fuzzy Hash: 9E12D071901394ABEB248F39CC49FAF7BBAAF85710F104129F915EB2E1DB749942CB50
                                                                                    Function 0066F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0066F998
                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006AF474
                                                                                    • IsIconic.USER32(00000000), ref: 006AF47D
                                                                                    • ShowWindow.USER32(00000000,00000009), ref: 006AF48A
                                                                                    • SetForegroundWindow.USER32(00000000), ref: 006AF494
                                                                                    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 006AF4AA
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 006AF4B1
                                                                                    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 006AF4BD
                                                                                    • AttachThreadInput.USER32(?,00000000,00000001), ref: 006AF4CE
                                                                                    • AttachThreadInput.USER32(?,00000000,00000001), ref: 006AF4D6
                                                                                    • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 006AF4DE
                                                                                    • SetForegroundWindow.USER32(00000000), ref: 006AF4E1
                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 006AF4F6
                                                                                    • keybd_event.USER32(00000012,00000000), ref: 006AF501
                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 006AF50B
                                                                                    • keybd_event.USER32(00000012,00000000), ref: 006AF510
                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 006AF519
                                                                                    • keybd_event.USER32(00000012,00000000), ref: 006AF51E
                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 006AF528
                                                                                    • keybd_event.USER32(00000012,00000000), ref: 006AF52D
                                                                                    • SetForegroundWindow.USER32(00000000), ref: 006AF530
                                                                                    • AttachThreadInput.USER32(?,000000FF,00000000), ref: 006AF557
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                    • String ID: Shell_TrayWnd
                                                                                    • API String ID: 4125248594-2988720461
                                                                                    • Opcode ID: 6e7a55e0a2daabb2dbdf135f40d2ebffafc350b37bfaa3447026c113ef2272cc
                                                                                    • Instruction ID: 5a95207ec0424450c97d45a8733002ef173f32789b726257dd0510b2dd7c7af3
                                                                                    • Opcode Fuzzy Hash: 6e7a55e0a2daabb2dbdf135f40d2ebffafc350b37bfaa3447026c113ef2272cc
                                                                                    • Instruction Fuzzy Hash: 56317271A40358BFEB206BF55C8AFBF7E6EEB45B60F101025FA00EA1D1C6B05D11AE61
                                                                                    Function 006B1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006B170D
                                                                                      • Part of subcall function 006B16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006B173A
                                                                                      • Part of subcall function 006B16C3: GetLastError.KERNEL32 ref: 006B174A
                                                                                    • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 006B1286
                                                                                    • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 006B12A8
                                                                                    • CloseHandle.KERNEL32(?), ref: 006B12B9
                                                                                    • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 006B12D1
                                                                                    • GetProcessWindowStation.USER32 ref: 006B12EA
                                                                                    • SetProcessWindowStation.USER32(00000000), ref: 006B12F4
                                                                                    • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 006B1310
                                                                                      • Part of subcall function 006B10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006B11FC), ref: 006B10D4
                                                                                      • Part of subcall function 006B10BF: CloseHandle.KERNEL32(?,?,006B11FC), ref: 006B10E9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                                                    • String ID: $default$winsta0$Zq
                                                                                    • API String ID: 22674027-3569899062
                                                                                    • Opcode ID: 4fef1097bc2161919b68e67d37a673cb05c590c4ff28c6b942a7690e2f609d9e
                                                                                    • Instruction ID: 10c47d57d301f2c9d1868eddfa755782b8720605b6bcbcf7d603e816121b01d2
                                                                                    • Opcode Fuzzy Hash: 4fef1097bc2161919b68e67d37a673cb05c590c4ff28c6b942a7690e2f609d9e
                                                                                    • Instruction Fuzzy Hash: 35819FB1900349BFDF209FA4DC59FEE7BBAEF05714F144129F910AA2A0DB318985CB60
                                                                                    Function 006B0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006B1114
                                                                                      • Part of subcall function 006B10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B1120
                                                                                      • Part of subcall function 006B10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B112F
                                                                                      • Part of subcall function 006B10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B1136
                                                                                      • Part of subcall function 006B10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006B114D
                                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006B0BCC
                                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 006B0C00
                                                                                    • GetLengthSid.ADVAPI32(?), ref: 006B0C17
                                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 006B0C51
                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006B0C6D
                                                                                    • GetLengthSid.ADVAPI32(?), ref: 006B0C84
                                                                                    • GetProcessHeap.KERNEL32(00000008,00000008), ref: 006B0C8C
                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 006B0C93
                                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 006B0CB4
                                                                                    • CopySid.ADVAPI32(00000000), ref: 006B0CBB
                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 006B0CEA
                                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006B0D0C
                                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 006B0D1E
                                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006B0D45
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B0D4C
                                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006B0D55
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B0D5C
                                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006B0D65
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B0D6C
                                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 006B0D78
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B0D7F
                                                                                      • Part of subcall function 006B1193: GetProcessHeap.KERNEL32(00000008,006B0BB1,?,00000000,?,006B0BB1,?), ref: 006B11A1
                                                                                      • Part of subcall function 006B1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,006B0BB1,?), ref: 006B11A8
                                                                                      • Part of subcall function 006B1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,006B0BB1,?), ref: 006B11B7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                    • String ID:
                                                                                    • API String ID: 4175595110-0
                                                                                    • Opcode ID: 9eaa5b684d3aef9a07a0ded936eecb147692a3e49dc007dc08b2a5f441becb1b
                                                                                    • Instruction ID: 4703d2f15f0df04b0270b98e7ecda986f9a9cfa727f29f946df02e3d41b34026
                                                                                    • Opcode Fuzzy Hash: 9eaa5b684d3aef9a07a0ded936eecb147692a3e49dc007dc08b2a5f441becb1b
                                                                                    • Instruction Fuzzy Hash: 8D7150B190020AABEF10DFA4DC84FEFBBBABF05310F144515E915AB291D771A946CB60
                                                                                    Function 006CEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenClipboard.USER32(006ECC08), ref: 006CEB29
                                                                                    • IsClipboardFormatAvailable.USER32(0000000D), ref: 006CEB37
                                                                                    • GetClipboardData.USER32(0000000D), ref: 006CEB43
                                                                                    • CloseClipboard.USER32 ref: 006CEB4F
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 006CEB87
                                                                                    • CloseClipboard.USER32 ref: 006CEB91
                                                                                    • GlobalUnlock.KERNEL32(00000000,00000000), ref: 006CEBBC
                                                                                    • IsClipboardFormatAvailable.USER32(00000001), ref: 006CEBC9
                                                                                    • GetClipboardData.USER32(00000001), ref: 006CEBD1
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 006CEBE2
                                                                                    • GlobalUnlock.KERNEL32(00000000,?), ref: 006CEC22
                                                                                    • IsClipboardFormatAvailable.USER32(0000000F), ref: 006CEC38
                                                                                    • GetClipboardData.USER32(0000000F), ref: 006CEC44
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 006CEC55
                                                                                    • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 006CEC77
                                                                                    • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 006CEC94
                                                                                    • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 006CECD2
                                                                                    • GlobalUnlock.KERNEL32(00000000,?,?), ref: 006CECF3
                                                                                    • CountClipboardFormats.USER32 ref: 006CED14
                                                                                    • CloseClipboard.USER32 ref: 006CED59
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                                                    • String ID:
                                                                                    • API String ID: 420908878-0
                                                                                    • Opcode ID: 2ad140b4631863960f04f7851859d794337752d120597d5bb19d2e677d673ad4
                                                                                    • Instruction ID: a93dabdcf46f52e6363cf72ed7edb501f66ac4bc7a180ccbb268770cd562bf25
                                                                                    • Opcode Fuzzy Hash: 2ad140b4631863960f04f7851859d794337752d120597d5bb19d2e677d673ad4
                                                                                    • Instruction Fuzzy Hash: 526178342043419FD310EF64D885F7A7BB6EF84724F14551DF8569B2A2DB32E90ACBA2
                                                                                    Function 006C698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 006C69BE
                                                                                    • FindClose.KERNEL32(00000000), ref: 006C6A12
                                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006C6A4E
                                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006C6A75
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • FileTimeToSystemTime.KERNEL32(?,?), ref: 006C6AB2
                                                                                    • FileTimeToSystemTime.KERNEL32(?,?), ref: 006C6ADF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                                                    • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                                                    • API String ID: 3830820486-3289030164
                                                                                    • Opcode ID: a194867a16ae46686a410c925fa1bec71d71c1185f40a6a6aff58ecee23d3858
                                                                                    • Instruction ID: 55b9269ea117e0849a8885d48441a8a2d6afd6c0bf19c144b52eac8f2a9c33d0
                                                                                    • Opcode Fuzzy Hash: a194867a16ae46686a410c925fa1bec71d71c1185f40a6a6aff58ecee23d3858
                                                                                    • Instruction Fuzzy Hash: EBD170B1508300AEC354EBA4D881EBBB7EEEF88705F44491DF985C7191EB34DA48CB66
                                                                                    Function 006C9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 006C9663
                                                                                    • GetFileAttributesW.KERNEL32(?), ref: 006C96A1
                                                                                    • SetFileAttributesW.KERNEL32(?,?), ref: 006C96BB
                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 006C96D3
                                                                                    • FindClose.KERNEL32(00000000), ref: 006C96DE
                                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 006C96FA
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006C974A
                                                                                    • SetCurrentDirectoryW.KERNEL32(00716B7C), ref: 006C9768
                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 006C9772
                                                                                    • FindClose.KERNEL32(00000000), ref: 006C977F
                                                                                    • FindClose.KERNEL32(00000000), ref: 006C978F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                    • String ID: *.*
                                                                                    • API String ID: 1409584000-438819550
                                                                                    • Opcode ID: 6dd84bc7b34e203e0f8b44e9061803ff499856138d9200d032b614de3506a1ef
                                                                                    • Instruction ID: 49bfabc9e15f468ebc2b8ce540910f13c6c8f9e38c160b7bc91420738b677efc
                                                                                    • Opcode Fuzzy Hash: 6dd84bc7b34e203e0f8b44e9061803ff499856138d9200d032b614de3506a1ef
                                                                                    • Instruction Fuzzy Hash: 8431CF725412496EDF24AFB9DC4DEEE37AEEF09320F10405AE915E21D0EB74DE818A34
                                                                                    Function 006C979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 006C97BE
                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 006C9819
                                                                                    • FindClose.KERNEL32(00000000), ref: 006C9824
                                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 006C9840
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006C9890
                                                                                    • SetCurrentDirectoryW.KERNEL32(00716B7C), ref: 006C98AE
                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 006C98B8
                                                                                    • FindClose.KERNEL32(00000000), ref: 006C98C5
                                                                                    • FindClose.KERNEL32(00000000), ref: 006C98D5
                                                                                      • Part of subcall function 006BDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 006BDB00
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                                    • String ID: *.*
                                                                                    • API String ID: 2640511053-438819550
                                                                                    • Opcode ID: 48d62071ca1e9d8634956b195195c6a0319034dc68147154a42c9df93d6035a1
                                                                                    • Instruction ID: b28cdda6c6fd17f741d3c81bcb38bed650628fba32550e26234ea6eb48fce34b
                                                                                    • Opcode Fuzzy Hash: 48d62071ca1e9d8634956b195195c6a0319034dc68147154a42c9df93d6035a1
                                                                                    • Instruction Fuzzy Hash: 8E31D3715023596EDB20AFB8DC4DEEE37AEDF06320F204559E914A32D0DB71DE858A34
                                                                                    Function 006DBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006DC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006DB6AE,?,?), ref: 006DC9B5
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DC9F1
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DCA68
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DCA9E
                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006DBF3E
                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 006DBFA9
                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 006DBFCD
                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 006DC02C
                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 006DC0E7
                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 006DC154
                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 006DC1E9
                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 006DC23A
                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 006DC2E3
                                                                                    • RegCloseKey.ADVAPI32(?,?,00000000), ref: 006DC382
                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 006DC38F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                                                    • String ID:
                                                                                    • API String ID: 3102970594-0
                                                                                    • Opcode ID: 5745245e2018156df20c6333104fb52aa3e8272b4ea2ce1778a96b064d2c6921
                                                                                    • Instruction ID: 0603fdee3eb05de5c0c80fb6936fecbde128d37c0d501badd67b276071483015
                                                                                    • Opcode Fuzzy Hash: 5745245e2018156df20c6333104fb52aa3e8272b4ea2ce1778a96b064d2c6921
                                                                                    • Instruction Fuzzy Hash: DD024E71A04205DFD714CF24C895E2ABBE6AF49314F19849DF849CB3A2DB31ED46CB51
                                                                                    Function 006C8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocalTime.KERNEL32(?), ref: 006C8257
                                                                                    • SystemTimeToFileTime.KERNEL32(?,?), ref: 006C8267
                                                                                    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 006C8273
                                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 006C8310
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006C8324
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006C8356
                                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 006C838C
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006C8395
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CurrentDirectoryTime$File$Local$System
                                                                                    • String ID: *.*
                                                                                    • API String ID: 1464919966-438819550
                                                                                    • Opcode ID: 6534f8f761729ac60513560f4b19c8b90419a564b5fc3be458671410c05b4fd8
                                                                                    • Instruction ID: 9f8de554f8785479e519110e0226a7bb65d0f7a1debc3a6df7e7fac6783d8159
                                                                                    • Opcode Fuzzy Hash: 6534f8f761729ac60513560f4b19c8b90419a564b5fc3be458671410c05b4fd8
                                                                                    • Instruction Fuzzy Hash: F6615B715043459FC720DF64C844EAEB3EAFF89310F04891EF98987251EB35E949CB96
                                                                                    Function 006BD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00653AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00653A97,?,?,00652E7F,?,?,?,00000000), ref: 00653AC2
                                                                                      • Part of subcall function 006BE199: GetFileAttributesW.KERNEL32(?,006BCF95), ref: 006BE19A
                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 006BD122
                                                                                    • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 006BD1DD
                                                                                    • MoveFileW.KERNEL32(?,?), ref: 006BD1F0
                                                                                    • DeleteFileW.KERNEL32(?,?,?,?), ref: 006BD20D
                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 006BD237
                                                                                      • Part of subcall function 006BD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,006BD21C,?,?), ref: 006BD2B2
                                                                                    • FindClose.KERNEL32(00000000,?,?,?), ref: 006BD253
                                                                                    • FindClose.KERNEL32(00000000), ref: 006BD264
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                                                    • String ID: \*.*
                                                                                    • API String ID: 1946585618-1173974218
                                                                                    • Opcode ID: 697330151f0efe3d94d31adfe339d0f32e81f3d12c2c94ceba358b8c279f0ddc
                                                                                    • Instruction ID: f71baf414ff11b25b40ee8e70ff0fb985f2370753fc9948fc39b695f89834eca
                                                                                    • Opcode Fuzzy Hash: 697330151f0efe3d94d31adfe339d0f32e81f3d12c2c94ceba358b8c279f0ddc
                                                                                    • Instruction Fuzzy Hash: 3E617E7180115DAFCF05EBE0C9929EDB7B6AF15301F204569E9017B292EB319F4DCB64
                                                                                    Function 006CED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                                    • String ID:
                                                                                    • API String ID: 1737998785-0
                                                                                    • Opcode ID: 60c85a4738b8ad7d053e7529c2434f472d6ecb5e42a3f7bfe4f4d07d0b0bd609
                                                                                    • Instruction ID: 8fa5eb18369fb1211ff82e615b655d6c7c2d9a47b8ccf60ef964251866f96789
                                                                                    • Opcode Fuzzy Hash: 60c85a4738b8ad7d053e7529c2434f472d6ecb5e42a3f7bfe4f4d07d0b0bd609
                                                                                    • Instruction Fuzzy Hash: 82417835204651AFE720DF15D888F6ABBA6EF44369F14809DE8168F762C736ED42CB90
                                                                                    Function 006BE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006B170D
                                                                                      • Part of subcall function 006B16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006B173A
                                                                                      • Part of subcall function 006B16C3: GetLastError.KERNEL32 ref: 006B174A
                                                                                    • ExitWindowsEx.USER32(?,00000000), ref: 006BE932
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                                    • String ID: $ $@$SeShutdownPrivilege
                                                                                    • API String ID: 2234035333-3163812486
                                                                                    • Opcode ID: 71306ddb1874d260cf3d2894631b550ac3339d5001fdc6735855070a16169f51
                                                                                    • Instruction ID: 4ff027316caace608b8ba425add95d6a13447ebb6196ff306ff8a89c9c77493d
                                                                                    • Opcode Fuzzy Hash: 71306ddb1874d260cf3d2894631b550ac3339d5001fdc6735855070a16169f51
                                                                                    • Instruction Fuzzy Hash: 100126F3610310AFEB6836B49C86FFB729E9714751F140426F913E61D1E5A25DC983A4
                                                                                    Function 006D1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 006D1276
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D1283
                                                                                    • bind.WSOCK32(00000000,?,00000010), ref: 006D12BA
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D12C5
                                                                                    • closesocket.WSOCK32(00000000), ref: 006D12F4
                                                                                    • listen.WSOCK32(00000000,00000005), ref: 006D1303
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D130D
                                                                                    • closesocket.WSOCK32(00000000), ref: 006D133C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$closesocket$bindlistensocket
                                                                                    • String ID:
                                                                                    • API String ID: 540024437-0
                                                                                    • Opcode ID: a24656233d572e2ec8e52870bf86567840ea56e0e8f0e39a3513a17dfdcd3999
                                                                                    • Instruction ID: e89b7c5537edd60835c56afe672cc10003f4d17a3159f99a41d890893f48b9ae
                                                                                    • Opcode Fuzzy Hash: a24656233d572e2ec8e52870bf86567840ea56e0e8f0e39a3513a17dfdcd3999
                                                                                    • Instruction Fuzzy Hash: 8F418231A00240AFD714DF64C5D4B6ABBE7AF46324F188189E8568F396C771ED86CBE1
                                                                                    Function 006BD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00653AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00653A97,?,?,00652E7F,?,?,?,00000000), ref: 00653AC2
                                                                                      • Part of subcall function 006BE199: GetFileAttributesW.KERNEL32(?,006BCF95), ref: 006BE19A
                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 006BD420
                                                                                    • DeleteFileW.KERNEL32(?,?,?,?), ref: 006BD470
                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 006BD481
                                                                                    • FindClose.KERNEL32(00000000), ref: 006BD498
                                                                                    • FindClose.KERNEL32(00000000), ref: 006BD4A1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                                    • String ID: \*.*
                                                                                    • API String ID: 2649000838-1173974218
                                                                                    • Opcode ID: 6cad8b4feffb47e5eb90d0350cc58787163e287e5030bcfd585fa1eff5de1c01
                                                                                    • Instruction ID: dc667dc028c68def8bd6ba354a136c7d2f141e94a74e0afd909c7c1e6f6b93c2
                                                                                    • Opcode Fuzzy Hash: 6cad8b4feffb47e5eb90d0350cc58787163e287e5030bcfd585fa1eff5de1c01
                                                                                    • Instruction Fuzzy Hash: 3A317E710083959FC344EF64C8928EFB7EAAE91311F444E2DF8D197291EB20AA4DC767
                                                                                    Function 0068E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: __floor_pentium4
                                                                                    • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                    • API String ID: 4168288129-2761157908
                                                                                    • Opcode ID: 177db334ae3145682b9ebf4ebcad18cc07e4b821fb13e7911335d145084012e6
                                                                                    • Instruction ID: 27d5a4e32f54308f3cd4f757d6b3c8cd924a2e071c75723e3a08637e87a6c2a5
                                                                                    • Opcode Fuzzy Hash: 177db334ae3145682b9ebf4ebcad18cc07e4b821fb13e7911335d145084012e6
                                                                                    • Instruction Fuzzy Hash: 8EC24C71E086288FDB65DF28DD407EAB7B6EB48305F1442EAD44DE7241E779AE818F40
                                                                                    Function 006C648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _wcslen.LIBCMT ref: 006C64DC
                                                                                    • CoInitialize.OLE32(00000000), ref: 006C6639
                                                                                    • CoCreateInstance.OLE32(006EFCF8,00000000,00000001,006EFB68,?), ref: 006C6650
                                                                                    • CoUninitialize.OLE32 ref: 006C68D4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                    • String ID: .lnk
                                                                                    • API String ID: 886957087-24824748
                                                                                    • Opcode ID: 94f15b6658be917438926d284b524e10f96667744b521ff09aa50623d4fea9d1
                                                                                    • Instruction ID: 2d348d7614715120772a0e06d0dfb01ac75eb8590bcac8f02dad9eb11a1df4d6
                                                                                    • Opcode Fuzzy Hash: 94f15b6658be917438926d284b524e10f96667744b521ff09aa50623d4fea9d1
                                                                                    • Instruction Fuzzy Hash: ABD13971508301AFC344EF24C881E6BB7EAFF94705F50496DF5958B2A1EB70E909CBA6
                                                                                    Function 006D22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetForegroundWindow.USER32(?,?,00000000), ref: 006D22E8
                                                                                      • Part of subcall function 006CE4EC: GetWindowRect.USER32(?,?), ref: 006CE504
                                                                                    • GetDesktopWindow.USER32 ref: 006D2312
                                                                                    • GetWindowRect.USER32(00000000), ref: 006D2319
                                                                                    • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 006D2355
                                                                                    • GetCursorPos.USER32(?), ref: 006D2381
                                                                                    • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006D23DF
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                                                    • String ID:
                                                                                    • API String ID: 2387181109-0
                                                                                    • Opcode ID: 18314b4370a5f20aaab16abcf7c83aba9cdbea3b35a8b74e84839083a4dd220f
                                                                                    • Instruction ID: 0540872a372c5e941583a274dc6b5f6b664b3f78829af9d3bffa9be5f516d51d
                                                                                    • Opcode Fuzzy Hash: 18314b4370a5f20aaab16abcf7c83aba9cdbea3b35a8b74e84839083a4dd220f
                                                                                    • Instruction Fuzzy Hash: 7931CF72904356ABCB20DF14C845B9BB7AAFF84310F00091EF9959B281DB35E909CB92
                                                                                    Function 006C9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 006C9B78
                                                                                    • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 006C9C8B
                                                                                      • Part of subcall function 006C3874: GetInputState.USER32 ref: 006C38CB
                                                                                      • Part of subcall function 006C3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006C3966
                                                                                    • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 006C9BA8
                                                                                    • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 006C9C75
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                                                    • String ID: *.*
                                                                                    • API String ID: 1972594611-438819550
                                                                                    • Opcode ID: cf6574eff1f17a61617cb133a3629bebd393fee126df8b614a02e92c9fb685c6
                                                                                    • Instruction ID: 88d17b55f3f099c746cc33fb8cfd41df6c74ac01fa7c0d5d074131a242250371
                                                                                    • Opcode Fuzzy Hash: cf6574eff1f17a61617cb133a3629bebd393fee126df8b614a02e92c9fb685c6
                                                                                    • Instruction Fuzzy Hash: 0041927190424AAFCF54DF64C889FFE7BB6EF05311F20415AE805A2291EB319E85CF64
                                                                                    Function 0066997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00669BB2
                                                                                    • DefDlgProcW.USER32(?,?,?,?,?), ref: 00669A4E
                                                                                    • GetSysColor.USER32(0000000F), ref: 00669B23
                                                                                    • SetBkColor.GDI32(?,00000000), ref: 00669B36
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Color$LongProcWindow
                                                                                    • String ID:
                                                                                    • API String ID: 3131106179-0
                                                                                    • Opcode ID: e9b50bbe4326d7f5667752593734820e571ccc8e42ed806d3842b9859be07f67
                                                                                    • Instruction ID: 0e2ce73aad1cd6b479be46ce91f5b751cf21b421d46b765fd8c5237890ada946
                                                                                    • Opcode Fuzzy Hash: e9b50bbe4326d7f5667752593734820e571ccc8e42ed806d3842b9859be07f67
                                                                                    • Instruction Fuzzy Hash: 24A10770109554AEE728AA7D8C98EFB26DFEB43310F15421EFD02C6791CA35DD02DA79
                                                                                    Function 006D1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006D304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 006D307A
                                                                                      • Part of subcall function 006D304E: _wcslen.LIBCMT ref: 006D309B
                                                                                    • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 006D185D
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D1884
                                                                                    • bind.WSOCK32(00000000,?,00000010), ref: 006D18DB
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D18E6
                                                                                    • closesocket.WSOCK32(00000000), ref: 006D1915
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                                                    • String ID:
                                                                                    • API String ID: 1601658205-0
                                                                                    • Opcode ID: 9d1fbb91f3b403fed0d5e883e7b5db7c5ebf8ecb1664e1900ffd42c1c7466011
                                                                                    • Instruction ID: f7dbd674a12e0d2b12ddd37a7a83ee105e37bcef9d7574bd65989c45ea1bc69d
                                                                                    • Opcode Fuzzy Hash: 9d1fbb91f3b403fed0d5e883e7b5db7c5ebf8ecb1664e1900ffd42c1c7466011
                                                                                    • Instruction Fuzzy Hash: 1D51B371A00200AFEB10EF24C896F6A77E6AB85718F04805DF9155F3D3DB71AD42CBA1
                                                                                    Function 006E1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                    • String ID:
                                                                                    • API String ID: 292994002-0
                                                                                    • Opcode ID: 3d89432d74221a1af258fad1bef4bb296ebd195477e896ce10cb60a4721d8d7d
                                                                                    • Instruction ID: 08f4eaf1dc46fb015fdfa1a6847fd606e49ecfd963246cc752c63b83ae49fd78
                                                                                    • Opcode Fuzzy Hash: 3d89432d74221a1af258fad1bef4bb296ebd195477e896ce10cb60a4721d8d7d
                                                                                    • Instruction Fuzzy Hash: B521A0317423815FD7208F2BC894B6A7BA7AF86725B289068E846CF351C775EC42DB94
                                                                                    Function 00658060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                                                    • API String ID: 0-1546025612
                                                                                    • Opcode ID: b371f8167a427788988ceb618b3623b999dbd2111a1b058299c5abadbdb82d88
                                                                                    • Instruction ID: 1cd3a99ee139774e0dc1ffc4d74cc63b47f33ec5ee11146d655b62495450ba46
                                                                                    • Opcode Fuzzy Hash: b371f8167a427788988ceb618b3623b999dbd2111a1b058299c5abadbdb82d88
                                                                                    • Instruction Fuzzy Hash: 76A25D70A0061ACFDF25CF58C9407EDB7B6AB54311F2481AAEC16A7B85EB709D85CB90
                                                                                    Function 006B8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • lstrlenW.KERNEL32(?,?,?,00000000), ref: 006B82AA
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: lstrlen
                                                                                    • String ID: ($tbq$|
                                                                                    • API String ID: 1659193697-2635483380
                                                                                    • Opcode ID: 41260900d8eb9d9c0b13824edac971f2258f34b2da8cb85248c0d46f72e218e8
                                                                                    • Instruction ID: 9d096e66c2b58dc9f3964d4fb9c31ed6cbeda5f05e2621a2748b83d4b183744d
                                                                                    • Opcode Fuzzy Hash: 41260900d8eb9d9c0b13824edac971f2258f34b2da8cb85248c0d46f72e218e8
                                                                                    • Instruction Fuzzy Hash: 993237B4A00705DFC728CF59C481AAAB7F5FF48710B15856EE49ADB3A1EB70E981CB44
                                                                                    Function 006BAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 006BAAAC
                                                                                    • SetKeyboardState.USER32(00000080), ref: 006BAAC8
                                                                                    • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 006BAB36
                                                                                    • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 006BAB88
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                                    • String ID:
                                                                                    • API String ID: 432972143-0
                                                                                    • Opcode ID: 7126b430e1dcd00e8aa747781812c715c60624917cf421d10e48bb49b909607a
                                                                                    • Instruction ID: 4ff96d3b049d203e29ffcd14205b856c609eb5d022f71476157eda8e4cdc06f8
                                                                                    • Opcode Fuzzy Hash: 7126b430e1dcd00e8aa747781812c715c60624917cf421d10e48bb49b909607a
                                                                                    • Instruction Fuzzy Hash: 7631F4B0A40258AFFF358BA4CC45BFA7BA7AB44320F04421AF5E1962D1D37589C6C766
                                                                                    Function 0068BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 0068BB7F
                                                                                      • Part of subcall function 006829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000), ref: 006829DE
                                                                                      • Part of subcall function 006829C8: GetLastError.KERNEL32(00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000,00000000), ref: 006829F0
                                                                                    • GetTimeZoneInformation.KERNEL32 ref: 0068BB91
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,?,0072121C,000000FF,?,0000003F,?,?), ref: 0068BC09
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,?,00721270,000000FF,?,0000003F,?,?,?,0072121C,000000FF,?,0000003F,?,?), ref: 0068BC36
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                                                                                    • String ID:
                                                                                    • API String ID: 806657224-0
                                                                                    • Opcode ID: ea5511106a8ba9997f2aa231fddf505d88e37e4f68f66aa189fe68faf388fe0e
                                                                                    • Instruction ID: 45d2ca2dcf2c7d56685e66680978ae3296fb41a0e7adeb9b3b311d75d776d251
                                                                                    • Opcode Fuzzy Hash: ea5511106a8ba9997f2aa231fddf505d88e37e4f68f66aa189fe68faf388fe0e
                                                                                    • Instruction Fuzzy Hash: 9031C070A04245DFCB20EF69DC80869BBFAFF65310715A3AAF020DB2A1D7309A42CB54
                                                                                    Function 006CCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InternetReadFile.WININET(?,?,00000400,?), ref: 006CCE89
                                                                                    • GetLastError.KERNEL32(?,00000000), ref: 006CCEEA
                                                                                    • SetEvent.KERNEL32(?,?,00000000), ref: 006CCEFE
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorEventFileInternetLastRead
                                                                                    • String ID:
                                                                                    • API String ID: 234945975-0
                                                                                    • Opcode ID: 5d6c586cd9e23abda69ec01aec51008668b54b0fbcd7f0b49fd96427c05c5e80
                                                                                    • Instruction ID: cb71f513a4b42d51bdf912eeed5083fb11b063c15da45bff113817f3502c75d9
                                                                                    • Opcode Fuzzy Hash: 5d6c586cd9e23abda69ec01aec51008668b54b0fbcd7f0b49fd96427c05c5e80
                                                                                    • Instruction Fuzzy Hash: DC21BDB19003059FEB20DF65C988FAA7BFAEF05324F10841EE64AD6251E770EE458B94
                                                                                    Function 006C5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 006C5CC1
                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 006C5D17
                                                                                    • FindClose.KERNEL32(?), ref: 006C5D5F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Find$File$CloseFirstNext
                                                                                    • String ID:
                                                                                    • API String ID: 3541575487-0
                                                                                    • Opcode ID: d4d9aa028372b1ee43bbc2986db0d3e97ce12cf742f0187f2e020aa5a30d6adc
                                                                                    • Instruction ID: b0b6ec1b5550ad3f6cf899015a6cffc147a0658582d6e91c69d831cdf0519f74
                                                                                    • Opcode Fuzzy Hash: d4d9aa028372b1ee43bbc2986db0d3e97ce12cf742f0187f2e020aa5a30d6adc
                                                                                    • Instruction Fuzzy Hash: B251A7346047018FC304CF28C894EA6B7E6FF49324F14855DE95A8B3A2CB30F945CB95
                                                                                    Function 00682622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsDebuggerPresent.KERNEL32 ref: 0068271A
                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00682724
                                                                                    • UnhandledExceptionFilter.KERNEL32(?), ref: 00682731
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                    • String ID:
                                                                                    • API String ID: 3906539128-0
                                                                                    • Opcode ID: 2098909cd6a851b71e6290f2de9f0dae9869be6d93f175b44a3f5eb5a69d5f27
                                                                                    • Instruction ID: 8f7d06f18663b74097b8c4cc49e0cc060572967e46c060a0542a1f444716a0bc
                                                                                    • Opcode Fuzzy Hash: 2098909cd6a851b71e6290f2de9f0dae9869be6d93f175b44a3f5eb5a69d5f27
                                                                                    • Instruction Fuzzy Hash: 8E31D574901319ABCB61DF69DC887DCB7B9AF08310F5082EAE40CA7261E7309F818F44
                                                                                    Function 006C51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 006C51DA
                                                                                    • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 006C5238
                                                                                    • SetErrorMode.KERNEL32(00000000), ref: 006C52A1
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorMode$DiskFreeSpace
                                                                                    • String ID:
                                                                                    • API String ID: 1682464887-0
                                                                                    • Opcode ID: 2a1295f96016de5dc4ff277c74006f926b6a18e1e3ba2337bba4cbf9f081c38c
                                                                                    • Instruction ID: 070101d5e5b0d253a9597409f3c3b5f62915873e15aed39395c4a0286362ee77
                                                                                    • Opcode Fuzzy Hash: 2a1295f96016de5dc4ff277c74006f926b6a18e1e3ba2337bba4cbf9f081c38c
                                                                                    • Instruction Fuzzy Hash: 22311A75A00618DFDB00DF54D884EEDBBB6FF49314F048099E805AB3A2DB35E95ACB91
                                                                                    Function 006B16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0066FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00670668
                                                                                      • Part of subcall function 0066FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00670685
                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006B170D
                                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006B173A
                                                                                    • GetLastError.KERNEL32 ref: 006B174A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                                                    • String ID:
                                                                                    • API String ID: 577356006-0
                                                                                    • Opcode ID: 63b27877331a7c25074a0de1c680d25743a3c87fd0bf6db859d5000572ad9bbf
                                                                                    • Instruction ID: 6e84e6f9c5ec9238ea5f0b3827c77fbad46c5892c3f0be01a48cc75534eb3af4
                                                                                    • Opcode Fuzzy Hash: 63b27877331a7c25074a0de1c680d25743a3c87fd0bf6db859d5000572ad9bbf
                                                                                    • Instruction Fuzzy Hash: 411191B2404304BFD7189F54ECC6DAAB7BEEF45724B20852EE4565B241EB70BC828B64
                                                                                    Function 006BD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 006BD608
                                                                                    • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 006BD645
                                                                                    • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 006BD650
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CloseControlCreateDeviceFileHandle
                                                                                    • String ID:
                                                                                    • API String ID: 33631002-0
                                                                                    • Opcode ID: ce4a83e0a1d505f161666bbce8d8a669309a4f1122198f5ace34be8900424c35
                                                                                    • Instruction ID: 33024e0127a03066356696cf2d8fc2dc6af0ab67708e79ba4cb17b3c5a9799a9
                                                                                    • Opcode Fuzzy Hash: ce4a83e0a1d505f161666bbce8d8a669309a4f1122198f5ace34be8900424c35
                                                                                    • Instruction Fuzzy Hash: FC113CB5E05228BFDB108F959C85FEFBFBDEB45B60F108115F904EB290D6704A058BA1
                                                                                    Function 006B1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 006B168C
                                                                                    • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006B16A1
                                                                                    • FreeSid.ADVAPI32(?), ref: 006B16B1
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                    • String ID:
                                                                                    • API String ID: 3429775523-0
                                                                                    • Opcode ID: 158f018aff65d6117e42ebe8de6f79808d880b4b7579e3d78dab0c6bbff49ec3
                                                                                    • Instruction ID: 886540065eac6ee693d01b437af317d8179863b37e91da2156d8b18bc089e94e
                                                                                    • Opcode Fuzzy Hash: 158f018aff65d6117e42ebe8de6f79808d880b4b7579e3d78dab0c6bbff49ec3
                                                                                    • Instruction Fuzzy Hash: 7BF0F471950309FBDB00DFE49C89AAEBBBDEB08614F504565E501E6181E775AA448B50
                                                                                    Function 006AD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetUserNameW.ADVAPI32(?,?), ref: 006AD28C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: NameUser
                                                                                    • String ID: X64
                                                                                    • API String ID: 2645101109-893830106
                                                                                    • Opcode ID: 80b55a74209bd0ef4e89bb80407576fe98f2afcc69c9e53a7f181e27e2d72937
                                                                                    • Instruction ID: 3977a583930fd3b113f8f272b201cbe10647833123f38f30236877e4121e5d69
                                                                                    • Opcode Fuzzy Hash: 80b55a74209bd0ef4e89bb80407576fe98f2afcc69c9e53a7f181e27e2d72937
                                                                                    • Instruction Fuzzy Hash: 5DD0C9B480111DEACB90DB90DCC8DD9B37DBB04315F100151F506A2040D7309A4A9F10
                                                                                    Function 0067CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                                    • Instruction ID: 20b7eb41ea83b6f3e7f07b723e583ec9fc42381a10472333490c156cf9628665
                                                                                    • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                                    • Instruction Fuzzy Hash: B5020D71E001199FDF24CFA9D8806EDBBF6EF48324F25826DD919E7384D731AA418B94
                                                                                    Function 0065CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: Variable is not of type 'Object'.$p#r
                                                                                    • API String ID: 0-4023953213
                                                                                    • Opcode ID: cb7f79bded7d1f29f3c9aeeb673e3624c687f9b20face65607dc1e7cd67230de
                                                                                    • Instruction ID: cdd45f74d555b6b82588ad12cfac7220a55e7b6f86677ee057d30c51f5e307fe
                                                                                    • Opcode Fuzzy Hash: cb7f79bded7d1f29f3c9aeeb673e3624c687f9b20face65607dc1e7cd67230de
                                                                                    • Instruction Fuzzy Hash: 34328A70900318DFDF14EF94C891AEDB7B6BF05315F148169E806AB392DB75AE4ACB60
                                                                                    Function 006C68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 006C6918
                                                                                    • FindClose.KERNEL32(00000000), ref: 006C6961
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Find$CloseFileFirst
                                                                                    • String ID:
                                                                                    • API String ID: 2295610775-0
                                                                                    • Opcode ID: 769e7e3ae6f78f630f490d8ccba629b3f6ae58b87fbde05f0dea7e50262b23fa
                                                                                    • Instruction ID: 3d3ac1df0f8400e8a8cc9041d9c86f516222d1372be1e0eaca78958f89f54d91
                                                                                    • Opcode Fuzzy Hash: 769e7e3ae6f78f630f490d8ccba629b3f6ae58b87fbde05f0dea7e50262b23fa
                                                                                    • Instruction Fuzzy Hash: 00117F716042019FC710DF29D885A26BBE6EF85329F14C69DF8698F3A2D730EC05CB95
                                                                                    Function 006C37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,006D4891,?,?,00000035,?), ref: 006C37E4
                                                                                    • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,006D4891,?,?,00000035,?), ref: 006C37F4
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorFormatLastMessage
                                                                                    • String ID:
                                                                                    • API String ID: 3479602957-0
                                                                                    • Opcode ID: ae0cf18e4b9f97d2b739a23565938bd30dece59a3cde219d7efa59283101d5f5
                                                                                    • Instruction ID: 0f9403b14d87698003079afb2a8004e2cc5460bf7fc774e2a202ac358bc9b89a
                                                                                    • Opcode Fuzzy Hash: ae0cf18e4b9f97d2b739a23565938bd30dece59a3cde219d7efa59283101d5f5
                                                                                    • Instruction Fuzzy Hash: 21F0E5B16043296EEB6017668C8DFEB3AAFEFC5771F004169F509D2281D9609905C6F4
                                                                                    Function 006BB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 006BB25D
                                                                                    • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 006BB270
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: InputSendkeybd_event
                                                                                    • String ID:
                                                                                    • API String ID: 3536248340-0
                                                                                    • Opcode ID: ee4c939464d41e1232badbc7858934ebc6939f57c0c457ab2b44f6bc75295b7f
                                                                                    • Instruction ID: d1385d7ee949539f291af0ea01de44bea269fd77be468bbedba855c08b640b10
                                                                                    • Opcode Fuzzy Hash: ee4c939464d41e1232badbc7858934ebc6939f57c0c457ab2b44f6bc75295b7f
                                                                                    • Instruction Fuzzy Hash: 9CF01D7180438DABDF059FA1C805BFE7BB5FF04315F109009F965A9191C3B9C6529F94
                                                                                    Function 006B10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006B11FC), ref: 006B10D4
                                                                                    • CloseHandle.KERNEL32(?,?,006B11FC), ref: 006B10E9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AdjustCloseHandlePrivilegesToken
                                                                                    • String ID:
                                                                                    • API String ID: 81990902-0
                                                                                    • Opcode ID: 843efba5518ddbdd170ab3b6ef55a41e4f66e982fd93fc7569e4d39e6e99d01b
                                                                                    • Instruction ID: 9e39e28502e62c7b261332bcbe0a35d8767073109c1a66978f2fbecf9b7dff08
                                                                                    • Opcode Fuzzy Hash: 843efba5518ddbdd170ab3b6ef55a41e4f66e982fd93fc7569e4d39e6e99d01b
                                                                                    • Instruction Fuzzy Hash: 4CE04F72014700BEE7252B11FC09EB37BAAEF04320B10882EF4A5844B1DB626C90DB14
                                                                                    Function 0068676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00686766,?,?,00000008,?,?,0068FEFE,00000000), ref: 00686998
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExceptionRaise
                                                                                    • String ID:
                                                                                    • API String ID: 3997070919-0
                                                                                    • Opcode ID: d811b66ee991dd336fbabdad8b7173da56c593afe22a61202bee17939b3bfea0
                                                                                    • Instruction ID: 30206c49386aa586b3f5e392a7c16154d8518c78156471123741a11da4b1db52
                                                                                    • Opcode Fuzzy Hash: d811b66ee991dd336fbabdad8b7173da56c593afe22a61202bee17939b3bfea0
                                                                                    • Instruction Fuzzy Hash: D0B15C71610609DFDB19DF28C48ABA57BE1FF05364F258658F89ACF2A2C735D982CB40
                                                                                    Function 0066B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID: 0-3916222277
                                                                                    • Opcode ID: d2d489fd91223d75a6f777bc909070cd738cd83248bbd0a8e67cd3af04946295
                                                                                    • Instruction ID: 446c7e231b348f4a62fe010675a8515942a00c9ec91be5e23ac38e537b512fe2
                                                                                    • Opcode Fuzzy Hash: d2d489fd91223d75a6f777bc909070cd738cd83248bbd0a8e67cd3af04946295
                                                                                    • Instruction Fuzzy Hash: FF124F71900229DFCB64DF58C8816EEB7F6EF49710F1481AAE849EB255DB349E81CF90
                                                                                    Function 006CEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • BlockInput.USER32(00000001), ref: 006CEABD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: BlockInput
                                                                                    • String ID:
                                                                                    • API String ID: 3456056419-0
                                                                                    • Opcode ID: df7fc2f1ceadfb195b8e4d5dcb9d7494ee1a52e1a75c19188b98cc64d0d02187
                                                                                    • Instruction ID: 626a13c812b0cc746a76deb742486ea4e5fafb63c6102309bf929a73320512e3
                                                                                    • Opcode Fuzzy Hash: df7fc2f1ceadfb195b8e4d5dcb9d7494ee1a52e1a75c19188b98cc64d0d02187
                                                                                    • Instruction Fuzzy Hash: FFE01A312002049FC710EFA9D844E9AB7EAEF98770F00841AFC49CB351DA71A8458B90
                                                                                    Function 006709D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,006703EE), ref: 006709DA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                    • String ID:
                                                                                    • API String ID: 3192549508-0
                                                                                    • Opcode ID: 7af92af29e3e2835a3c6ef9d6d413ca52bb54a91583f93b2dab6d699c4cdda7f
                                                                                    • Instruction ID: 25cbf59252ad5e869fbea7ea2c1462ea45d6f4da95848a2e98021508b6bf8e76
                                                                                    • Opcode Fuzzy Hash: 7af92af29e3e2835a3c6ef9d6d413ca52bb54a91583f93b2dab6d699c4cdda7f
                                                                                    • Instruction Fuzzy Hash:
                                                                                    Function 0067781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 0
                                                                                    • API String ID: 0-4108050209
                                                                                    • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                                    • Instruction ID: ea55067f3bce650750938dd29ebeb054c2e484f002aaa3008d1b98c278974905
                                                                                    • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                                    • Instruction Fuzzy Hash: 6151697160C7059BDB388568C85D7FE63979B12300F18C92AD98EC7382DA15DE42D39B
                                                                                    Function 006C2046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 0&r
                                                                                    • API String ID: 0-2801774518
                                                                                    • Opcode ID: 5fdbba6243012703b1ffd65a21380b586c2f8307d3e5d5f53326fb1fb2ca4602
                                                                                    • Instruction ID: af4e277e540151915c0897e289cdaf4fd210fb3301df89b7b11411e6b27026f3
                                                                                    • Opcode Fuzzy Hash: 5fdbba6243012703b1ffd65a21380b586c2f8307d3e5d5f53326fb1fb2ca4602
                                                                                    • Instruction Fuzzy Hash: 0421A5327206118BD728CE79C8226BA73E5E754310F15862EE4A7C77D1DE3AE905CB94
                                                                                    Function 00686DD9 Relevance: .6, Instructions: 637COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 5a472ff07d85d05f727ff4be22e3225b2eea148b3d4813847f30bbaf469ce69b
                                                                                    • Instruction ID: 9b9395c3af5b01aad249804f3994b9c6f792310dd381cbcc5fdb79ff3d258268
                                                                                    • Opcode Fuzzy Hash: 5a472ff07d85d05f727ff4be22e3225b2eea148b3d4813847f30bbaf469ce69b
                                                                                    • Instruction Fuzzy Hash: 3932F721D29F014DD723A634DC32335A64AAFB73C5F25D737E81AB5AA5EF29C5838201
                                                                                    Function 0066CC39 Relevance: .6, Instructions: 635COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 05d0120527d8a6a4a87eedf4f918a054bff30ddeec7773be4e8866deb0374f64
                                                                                    • Instruction ID: 0d577d81105725e53d6c6d3c17b45468a93f19d9c6f1cb8c608ae59f106fb62d
                                                                                    • Opcode Fuzzy Hash: 05d0120527d8a6a4a87eedf4f918a054bff30ddeec7773be4e8866deb0374f64
                                                                                    • Instruction Fuzzy Hash: 5232F231A041158BCF28EB2CC4946FDBBA3EF46330F28856AD49A9B391D634DD82DF50
                                                                                    Function 00657920 Relevance: .6, Instructions: 563COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b5322b17d153b3866eae85205fb34ab21c6b498bf16a3e5a7bc6a4d3d3394bfd
                                                                                    • Instruction ID: 485016905c1c5048b8dc0b1d07ee187b9f067ad4558646d09c084c55a965ac7a
                                                                                    • Opcode Fuzzy Hash: b5322b17d153b3866eae85205fb34ab21c6b498bf16a3e5a7bc6a4d3d3394bfd
                                                                                    • Instruction Fuzzy Hash: 1822BFB0A0060ADFDF14CF64D881AEEB7F7FF44300F148629E816A7691EB36A915CB54
                                                                                    Function 006591C0 Relevance: .5, Instructions: 475COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 5ef9f31bb364b4501912d6177c5e76962d72aec288bb6a9dbcc238059fd910a5
                                                                                    • Instruction ID: 49bbe3e5196d14263f4d6d75bea087577ed3ac5a852adb88955e0367a4f6f040
                                                                                    • Opcode Fuzzy Hash: 5ef9f31bb364b4501912d6177c5e76962d72aec288bb6a9dbcc238059fd910a5
                                                                                    • Instruction Fuzzy Hash: 0C02A6B0E00205EBDF04DF54D981AADBBB6FF54300F108169E816DB391EB35EA55CB95
                                                                                    Function 00689EEE Relevance: .3, Instructions: 294COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 318161ffe68a9ed4a56dd03adc6c2506e7e7ca77cfc8a2c22a5b84e21e1a143d
                                                                                    • Instruction ID: 1af8c5a886ef66615ab4c3127fba57dcb0d9eb899fa712aa83d2ef2ea36a3494
                                                                                    • Opcode Fuzzy Hash: 318161ffe68a9ed4a56dd03adc6c2506e7e7ca77cfc8a2c22a5b84e21e1a143d
                                                                                    • Instruction Fuzzy Hash: 42B11531D2AF914DD72396398831336B65DAFBB6D5F51E31BFC1674E22EB2285838140
                                                                                    Function 00671C77 Relevance: .3, Instructions: 254COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                                    • Instruction ID: 95c6cef6e02fff7b3ac91460d7d927245109fb6018c702bedbf7ff1b38208235
                                                                                    • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                                    • Instruction Fuzzy Hash: C59189725080A34ADB29463E85750BDFFE25E533A131A479FD4FACE2C1FE14C955DA20
                                                                                    Function 00671F32 Relevance: .2, Instructions: 244COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                                    • Instruction ID: 6ed0e4f2f7d3fc853c6308f41786bc0179ebd9c228150e9cb57bdfe91147c5c0
                                                                                    • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                                    • Instruction Fuzzy Hash: 4D9188726090A34EDB29423D847407EFFE35A933A131A879ED5FACF2C5EE24C555D620
                                                                                    Function 006719B0 Relevance: .2, Instructions: 240COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                                    • Instruction ID: 9ba4097245b1734aae40cd72530ceef1ca1864b559dc6f24b840e8109119c9d4
                                                                                    • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                                    • Instruction Fuzzy Hash: 5F9196722090A34ADB2D427E857407DFFE25A937A131A879FD4FACE2C1FE14C655D620
                                                                                    Function 00677A4A Relevance: .2, Instructions: 237COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 778822830b50343c2fe7bfe7eeab85b6075a20c49487bdfa1362008e436a3987
                                                                                    • Instruction ID: 061004b9f2bacc45485a89c549f79dae433e2fcd4b6173f48c2704c26383dee9
                                                                                    • Opcode Fuzzy Hash: 778822830b50343c2fe7bfe7eeab85b6075a20c49487bdfa1362008e436a3987
                                                                                    • Instruction Fuzzy Hash: 37618A313487099AEE349D2C8D95BFE2397DF51B00F20C91DE84ECB381D6119E42C759
                                                                                    Function 00677CA7 Relevance: .2, Instructions: 237COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 23157be08ea40ae05ef8f404202bd067ed3d6927eb421fb78a4652b40eeb44b8
                                                                                    • Instruction ID: a1b1bcb230303cce1cb8df43e1054414c8beeb003f7d48c69be79353dfc09d30
                                                                                    • Opcode Fuzzy Hash: 23157be08ea40ae05ef8f404202bd067ed3d6927eb421fb78a4652b40eeb44b8
                                                                                    • Instruction Fuzzy Hash: D8619B31248709A7DE388A688855BFF2397DF42704F20C95EE94FCB381EA12DD42C759
                                                                                    Function 00671706 Relevance: .2, Instructions: 232COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                                    • Instruction ID: c7a3f2eb01965a16c5b26ddd1ee6d2bee813bafffe4934e97c102cf2220c3927
                                                                                    • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                                    • Instruction Fuzzy Hash: 358176325090A34ADB6D463D85340BEFFE35A933A131A879FD4FACE2C1EE24C555E620
                                                                                    Function 0066D07D Relevance: .2, Instructions: 161COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 40266a6cdf263aa76b92f2ff44dbaa9fa5c49375f30cdc9f2d18a0093358e4e2
                                                                                    • Instruction ID: e1e1adae573d6b9152e072f5c173db7822c2c886f9e42e7a2411ffa6e0e7580d
                                                                                    • Opcode Fuzzy Hash: 40266a6cdf263aa76b92f2ff44dbaa9fa5c49375f30cdc9f2d18a0093358e4e2
                                                                                    • Instruction Fuzzy Hash: D851C6616867429FE30E9A209C02B80FB52FF92E10F0CCBCEE1454E8C7DB919949C7C1
                                                                                    Function 006D2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DeleteObject.GDI32(00000000), ref: 006D2B30
                                                                                    • DeleteObject.GDI32(00000000), ref: 006D2B43
                                                                                    • DestroyWindow.USER32 ref: 006D2B52
                                                                                    • GetDesktopWindow.USER32 ref: 006D2B6D
                                                                                    • GetWindowRect.USER32(00000000), ref: 006D2B74
                                                                                    • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 006D2CA3
                                                                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 006D2CB1
                                                                                    • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2CF8
                                                                                    • GetClientRect.USER32(00000000,?), ref: 006D2D04
                                                                                    • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 006D2D40
                                                                                    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2D62
                                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2D75
                                                                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2D80
                                                                                    • GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2D89
                                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2D98
                                                                                    • GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2DA1
                                                                                    • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2DA8
                                                                                    • GlobalFree.KERNEL32(00000000), ref: 006D2DB3
                                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2DC5
                                                                                    • OleLoadPicture.OLEAUT32(?,00000000,00000000,006EFC38,00000000), ref: 006D2DDB
                                                                                    • GlobalFree.KERNEL32(00000000), ref: 006D2DEB
                                                                                    • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 006D2E11
                                                                                    • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 006D2E30
                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D2E52
                                                                                    • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006D303F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                    • String ID: $AutoIt v3$DISPLAY$static
                                                                                    • API String ID: 2211948467-2373415609
                                                                                    • Opcode ID: f8ebb1c222643dfc2c41b10b91e08c325a71264c8db15c8565415b46b22eca2c
                                                                                    • Instruction ID: 882040ef6a606e311ac544b5e239e24a9b395125d174e38923ccf177fadc4217
                                                                                    • Opcode Fuzzy Hash: f8ebb1c222643dfc2c41b10b91e08c325a71264c8db15c8565415b46b22eca2c
                                                                                    • Instruction Fuzzy Hash: A5028C71900205AFDB14DF64CC89EAE7BBAFF48321F008559F915AB2A1DB74ED02CB60
                                                                                    Function 006E70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetTextColor.GDI32(?,00000000), ref: 006E712F
                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 006E7160
                                                                                    • GetSysColor.USER32(0000000F), ref: 006E716C
                                                                                    • SetBkColor.GDI32(?,000000FF), ref: 006E7186
                                                                                    • SelectObject.GDI32(?,?), ref: 006E7195
                                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 006E71C0
                                                                                    • GetSysColor.USER32(00000010), ref: 006E71C8
                                                                                    • CreateSolidBrush.GDI32(00000000), ref: 006E71CF
                                                                                    • FrameRect.USER32(?,?,00000000), ref: 006E71DE
                                                                                    • DeleteObject.GDI32(00000000), ref: 006E71E5
                                                                                    • InflateRect.USER32(?,000000FE,000000FE), ref: 006E7230
                                                                                    • FillRect.USER32(?,?,?), ref: 006E7262
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E7284
                                                                                      • Part of subcall function 006E73E8: GetSysColor.USER32(00000012), ref: 006E7421
                                                                                      • Part of subcall function 006E73E8: SetTextColor.GDI32(?,?), ref: 006E7425
                                                                                      • Part of subcall function 006E73E8: GetSysColorBrush.USER32(0000000F), ref: 006E743B
                                                                                      • Part of subcall function 006E73E8: GetSysColor.USER32(0000000F), ref: 006E7446
                                                                                      • Part of subcall function 006E73E8: GetSysColor.USER32(00000011), ref: 006E7463
                                                                                      • Part of subcall function 006E73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 006E7471
                                                                                      • Part of subcall function 006E73E8: SelectObject.GDI32(?,00000000), ref: 006E7482
                                                                                      • Part of subcall function 006E73E8: SetBkColor.GDI32(?,00000000), ref: 006E748B
                                                                                      • Part of subcall function 006E73E8: SelectObject.GDI32(?,?), ref: 006E7498
                                                                                      • Part of subcall function 006E73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 006E74B7
                                                                                      • Part of subcall function 006E73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006E74CE
                                                                                      • Part of subcall function 006E73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 006E74DB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                                                    • String ID:
                                                                                    • API String ID: 4124339563-0
                                                                                    • Opcode ID: f4a146b92859aa6abfbbcd18e6f343be24e084a63f98bcc6d461a7237cf8b815
                                                                                    • Instruction ID: 507321c08778cd75e43690b13a33be806b77a0f73b1000e8bc55e15171e5e642
                                                                                    • Opcode Fuzzy Hash: f4a146b92859aa6abfbbcd18e6f343be24e084a63f98bcc6d461a7237cf8b815
                                                                                    • Instruction Fuzzy Hash: 9CA1B372009381BFD7009F64DC88E9B7BAAFF49330F101A19FA629A1E1D771E946DB51
                                                                                    Function 00668D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DestroyWindow.USER32(?,?), ref: 00668E14
                                                                                    • SendMessageW.USER32(?,00001308,?,00000000), ref: 006A6AC5
                                                                                    • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 006A6AFE
                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 006A6F43
                                                                                      • Part of subcall function 00668F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00668BE8,?,00000000,?,?,?,?,00668BBA,00000000,?), ref: 00668FC5
                                                                                    • SendMessageW.USER32(?,00001053), ref: 006A6F7F
                                                                                    • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 006A6F96
                                                                                    • ImageList_Destroy.COMCTL32(00000000,?), ref: 006A6FAC
                                                                                    • ImageList_Destroy.COMCTL32(00000000,?), ref: 006A6FB7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                                                    • String ID: 0
                                                                                    • API String ID: 2760611726-4108050209
                                                                                    • Opcode ID: 74ba9535e4cb59633c10b525a7cd7490ace9ca92a7b01288d153bd08008807f2
                                                                                    • Instruction ID: 0fe17d434cedca911f8db00489b846801ddfe4c9ba868f882698b89b2eb3b8d4
                                                                                    • Opcode Fuzzy Hash: 74ba9535e4cb59633c10b525a7cd7490ace9ca92a7b01288d153bd08008807f2
                                                                                    • Instruction Fuzzy Hash: 7D12AC30204241DFDB25EF24C894BA6B7E3FF5A310F588569F5858B261CB32AC92CF95
                                                                                    Function 006D2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DestroyWindow.USER32(00000000), ref: 006D273E
                                                                                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 006D286A
                                                                                    • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 006D28A9
                                                                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 006D28B9
                                                                                    • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 006D2900
                                                                                    • GetClientRect.USER32(00000000,?), ref: 006D290C
                                                                                    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 006D2955
                                                                                    • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 006D2964
                                                                                    • GetStockObject.GDI32(00000011), ref: 006D2974
                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 006D2978
                                                                                    • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 006D2988
                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 006D2991
                                                                                    • DeleteDC.GDI32(00000000), ref: 006D299A
                                                                                    • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006D29C6
                                                                                    • SendMessageW.USER32(00000030,00000000,00000001), ref: 006D29DD
                                                                                    • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 006D2A1D
                                                                                    • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 006D2A31
                                                                                    • SendMessageW.USER32(00000404,00000001,00000000), ref: 006D2A42
                                                                                    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 006D2A77
                                                                                    • GetStockObject.GDI32(00000011), ref: 006D2A82
                                                                                    • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 006D2A8D
                                                                                    • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 006D2A97
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                                    • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                                    • API String ID: 2910397461-517079104
                                                                                    • Opcode ID: 050a8a7432309948cda3fec6499712fb16f5b25e4ba4ef6757bc08e880e66206
                                                                                    • Instruction ID: 0e790e7b56b7d6fa2e3a3613a3c85a714828ebe42083a5964337ae722d8d6d48
                                                                                    • Opcode Fuzzy Hash: 050a8a7432309948cda3fec6499712fb16f5b25e4ba4ef6757bc08e880e66206
                                                                                    • Instruction Fuzzy Hash: 55B17E71A00205AFEB24DF68DC89FAE7BAAFB19711F008119F914EB291D774ED41CB94
                                                                                    Function 006C4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 006C4AED
                                                                                    • GetDriveTypeW.KERNEL32(?,006ECB68,?,\\.\,006ECC08), ref: 006C4BCA
                                                                                    • SetErrorMode.KERNEL32(00000000,006ECB68,?,\\.\,006ECC08), ref: 006C4D36
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorMode$DriveType
                                                                                    • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                                    • API String ID: 2907320926-4222207086
                                                                                    • Opcode ID: eeb76855415a9fa50e962fdb5a8b69151c1d1d4a9830ca76da5bc9d9aad7b91b
                                                                                    • Instruction ID: 84a779a271ed94c9fa1f9c90afd4c195a2717316a086f3e50e506dc4bd34586d
                                                                                    • Opcode Fuzzy Hash: eeb76855415a9fa50e962fdb5a8b69151c1d1d4a9830ca76da5bc9d9aad7b91b
                                                                                    • Instruction Fuzzy Hash: 1361A0707062059BCB14DF28CAA2EF977B3EB04740B20441DF846AB2A1DE39ED86DB55
                                                                                    Function 006E73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetSysColor.USER32(00000012), ref: 006E7421
                                                                                    • SetTextColor.GDI32(?,?), ref: 006E7425
                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 006E743B
                                                                                    • GetSysColor.USER32(0000000F), ref: 006E7446
                                                                                    • CreateSolidBrush.GDI32(?), ref: 006E744B
                                                                                    • GetSysColor.USER32(00000011), ref: 006E7463
                                                                                    • CreatePen.GDI32(00000000,00000001,00743C00), ref: 006E7471
                                                                                    • SelectObject.GDI32(?,00000000), ref: 006E7482
                                                                                    • SetBkColor.GDI32(?,00000000), ref: 006E748B
                                                                                    • SelectObject.GDI32(?,?), ref: 006E7498
                                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 006E74B7
                                                                                    • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006E74CE
                                                                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 006E74DB
                                                                                    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 006E752A
                                                                                    • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 006E7554
                                                                                    • InflateRect.USER32(?,000000FD,000000FD), ref: 006E7572
                                                                                    • DrawFocusRect.USER32(?,?), ref: 006E757D
                                                                                    • GetSysColor.USER32(00000011), ref: 006E758E
                                                                                    • SetTextColor.GDI32(?,00000000), ref: 006E7596
                                                                                    • DrawTextW.USER32(?,006E70F5,000000FF,?,00000000), ref: 006E75A8
                                                                                    • SelectObject.GDI32(?,?), ref: 006E75BF
                                                                                    • DeleteObject.GDI32(?), ref: 006E75CA
                                                                                    • SelectObject.GDI32(?,?), ref: 006E75D0
                                                                                    • DeleteObject.GDI32(?), ref: 006E75D5
                                                                                    • SetTextColor.GDI32(?,?), ref: 006E75DB
                                                                                    • SetBkColor.GDI32(?,?), ref: 006E75E5
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                    • String ID:
                                                                                    • API String ID: 1996641542-0
                                                                                    • Opcode ID: 3abdc8d663d061a21d18bdd4251cfa5ee386d3b19b284b8e227bb9d8450eb1af
                                                                                    • Instruction ID: c8bd0b061c45ae9591526f13ed83616383813b8a06c07768c2417b70721cf880
                                                                                    • Opcode Fuzzy Hash: 3abdc8d663d061a21d18bdd4251cfa5ee386d3b19b284b8e227bb9d8450eb1af
                                                                                    • Instruction Fuzzy Hash: C7617C72901358AFDF009FA8DC88EEEBFBAEB09320F105115F911AB2A1D7709941DF90
                                                                                    Function 006E0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCursorPos.USER32(?), ref: 006E1128
                                                                                    • GetDesktopWindow.USER32 ref: 006E113D
                                                                                    • GetWindowRect.USER32(00000000), ref: 006E1144
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E1199
                                                                                    • DestroyWindow.USER32(?), ref: 006E11B9
                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 006E11ED
                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006E120B
                                                                                    • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 006E121D
                                                                                    • SendMessageW.USER32(00000000,00000421,?,?), ref: 006E1232
                                                                                    • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 006E1245
                                                                                    • IsWindowVisible.USER32(00000000), ref: 006E12A1
                                                                                    • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 006E12BC
                                                                                    • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 006E12D0
                                                                                    • GetWindowRect.USER32(00000000,?), ref: 006E12E8
                                                                                    • MonitorFromPoint.USER32(?,?,00000002), ref: 006E130E
                                                                                    • GetMonitorInfoW.USER32(00000000,?), ref: 006E1328
                                                                                    • CopyRect.USER32(?,?), ref: 006E133F
                                                                                    • SendMessageW.USER32(00000000,00000412,00000000), ref: 006E13AA
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                                    • String ID: ($0$tooltips_class32
                                                                                    • API String ID: 698492251-4156429822
                                                                                    • Opcode ID: e631a5eed8c8d331c17aa4c9976d837dd8cbf238d008e39a75f7c790fea1665e
                                                                                    • Instruction ID: 382b1a2fed5d12e51fa7a4300dded0c91152386c4de6d040229e587eed7bd700
                                                                                    • Opcode Fuzzy Hash: e631a5eed8c8d331c17aa4c9976d837dd8cbf238d008e39a75f7c790fea1665e
                                                                                    • Instruction Fuzzy Hash: 6CB1BD71604380AFD744DF65C884BABBBE6FF85310F00891CF9999B2A1DB31E845DBA5
                                                                                    Function 00668891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00668968
                                                                                    • GetSystemMetrics.USER32(00000007), ref: 00668970
                                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0066899B
                                                                                    • GetSystemMetrics.USER32(00000008), ref: 006689A3
                                                                                    • GetSystemMetrics.USER32(00000004), ref: 006689C8
                                                                                    • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 006689E5
                                                                                    • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 006689F5
                                                                                    • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00668A28
                                                                                    • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00668A3C
                                                                                    • GetClientRect.USER32(00000000,000000FF), ref: 00668A5A
                                                                                    • GetStockObject.GDI32(00000011), ref: 00668A76
                                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 00668A81
                                                                                      • Part of subcall function 0066912D: GetCursorPos.USER32(?), ref: 00669141
                                                                                      • Part of subcall function 0066912D: ScreenToClient.USER32(00000000,?), ref: 0066915E
                                                                                      • Part of subcall function 0066912D: GetAsyncKeyState.USER32(00000001), ref: 00669183
                                                                                      • Part of subcall function 0066912D: GetAsyncKeyState.USER32(00000002), ref: 0066919D
                                                                                    • SetTimer.USER32(00000000,00000000,00000028,006690FC), ref: 00668AA8
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                                    • String ID: AutoIt v3 GUI
                                                                                    • API String ID: 1458621304-248962490
                                                                                    • Opcode ID: abedd0f24939144e168f47a58c4c58eb24e3cfb295f0000dc09f1b03842dd852
                                                                                    • Instruction ID: aa63aa16ff072555aeebf47a9140dd8e2e385ae03c673ae21c6979cdb608124d
                                                                                    • Opcode Fuzzy Hash: abedd0f24939144e168f47a58c4c58eb24e3cfb295f0000dc09f1b03842dd852
                                                                                    • Instruction Fuzzy Hash: 97B16D71A002499FDB14DFA8DC85BEE3BB6FB48314F154229FA15AB290DB34E842CF54
                                                                                    Function 006B0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006B1114
                                                                                      • Part of subcall function 006B10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B1120
                                                                                      • Part of subcall function 006B10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B112F
                                                                                      • Part of subcall function 006B10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B1136
                                                                                      • Part of subcall function 006B10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006B114D
                                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006B0DF5
                                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 006B0E29
                                                                                    • GetLengthSid.ADVAPI32(?), ref: 006B0E40
                                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 006B0E7A
                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006B0E96
                                                                                    • GetLengthSid.ADVAPI32(?), ref: 006B0EAD
                                                                                    • GetProcessHeap.KERNEL32(00000008,00000008), ref: 006B0EB5
                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 006B0EBC
                                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 006B0EDD
                                                                                    • CopySid.ADVAPI32(00000000), ref: 006B0EE4
                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 006B0F13
                                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006B0F35
                                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 006B0F47
                                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006B0F6E
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B0F75
                                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006B0F7E
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B0F85
                                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006B0F8E
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B0F95
                                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 006B0FA1
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B0FA8
                                                                                      • Part of subcall function 006B1193: GetProcessHeap.KERNEL32(00000008,006B0BB1,?,00000000,?,006B0BB1,?), ref: 006B11A1
                                                                                      • Part of subcall function 006B1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,006B0BB1,?), ref: 006B11A8
                                                                                      • Part of subcall function 006B1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,006B0BB1,?), ref: 006B11B7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                    • String ID:
                                                                                    • API String ID: 4175595110-0
                                                                                    • Opcode ID: 5d981961a03870b862071aa68049471593434bfa6f2c3dc669a5f585de0c7ce2
                                                                                    • Instruction ID: 0bd771824b85a8a641217238f8a98cc0cb896e8a3a8b70b6615c1cd6225f145c
                                                                                    • Opcode Fuzzy Hash: 5d981961a03870b862071aa68049471593434bfa6f2c3dc669a5f585de0c7ce2
                                                                                    • Instruction Fuzzy Hash: FA7141B190020AABEF209FA4DC45FEFBBBEBF05310F148155F915AA291D7719946CB60
                                                                                    Function 006DC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006DC4BD
                                                                                    • RegCreateKeyExW.ADVAPI32(?,?,00000000,006ECC08,00000000,?,00000000,?,?), ref: 006DC544
                                                                                    • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 006DC5A4
                                                                                    • _wcslen.LIBCMT ref: 006DC5F4
                                                                                    • _wcslen.LIBCMT ref: 006DC66F
                                                                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 006DC6B2
                                                                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 006DC7C1
                                                                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 006DC84D
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 006DC881
                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 006DC88E
                                                                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 006DC960
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                                                    • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                    • API String ID: 9721498-966354055
                                                                                    • Opcode ID: da3d693fa1db6ac7125adbfacd6ad90ebf90d092117574733a8e945a6d93e7ef
                                                                                    • Instruction ID: 3a2aa4c144e45a88d4754e80dd7b9a3ec27a69c405bcde477253d9f72ec5f826
                                                                                    • Opcode Fuzzy Hash: da3d693fa1db6ac7125adbfacd6ad90ebf90d092117574733a8e945a6d93e7ef
                                                                                    • Instruction Fuzzy Hash: 82127A35A042019FC754DF14C891E6ABBE6FF88725F04885DF88A9B3A2DB31ED45CB85
                                                                                    Function 006E091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CharUpperBuffW.USER32(?,?), ref: 006E09C6
                                                                                    • _wcslen.LIBCMT ref: 006E0A01
                                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 006E0A54
                                                                                    • _wcslen.LIBCMT ref: 006E0A8A
                                                                                    • _wcslen.LIBCMT ref: 006E0B06
                                                                                    • _wcslen.LIBCMT ref: 006E0B81
                                                                                      • Part of subcall function 0066F9F2: _wcslen.LIBCMT ref: 0066F9FD
                                                                                      • Part of subcall function 006B2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006B2BFA
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                                    • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                                    • API String ID: 1103490817-4258414348
                                                                                    • Opcode ID: 9128d98daedaca4c661c19313b5ec802dafd7d1d91066195e133507adb310e31
                                                                                    • Instruction ID: 967e03e235ee0bd38184ed207c4a4602dbc983fd2b34eeb2bf25ce8ad8e2bb92
                                                                                    • Opcode Fuzzy Hash: 9128d98daedaca4c661c19313b5ec802dafd7d1d91066195e133507adb310e31
                                                                                    • Instruction Fuzzy Hash: 34E1C0712093818FC754DF29C45096AB7E3BF98314F14895CF8969B3A2DB71ED8ACB81
                                                                                    Function 006DC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$BuffCharUpper
                                                                                    • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                                    • API String ID: 1256254125-909552448
                                                                                    • Opcode ID: 2c1a71da03605701e20b2959f3c6abdea0e2dff63006cd880fd5b61540d9de7a
                                                                                    • Instruction ID: 4d4347568a55e34c21ba136b1f2a30b44b159bbf01082828d544cdd43913c1fd
                                                                                    • Opcode Fuzzy Hash: 2c1a71da03605701e20b2959f3c6abdea0e2dff63006cd880fd5b61540d9de7a
                                                                                    • Instruction Fuzzy Hash: 2771C332E1016F8BCB20DE6CC9515FA33A3ABA0774F15452AF8569B384EA35CD85C3A4
                                                                                    Function 006E833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _wcslen.LIBCMT ref: 006E835A
                                                                                    • _wcslen.LIBCMT ref: 006E836E
                                                                                    • _wcslen.LIBCMT ref: 006E8391
                                                                                    • _wcslen.LIBCMT ref: 006E83B4
                                                                                    • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 006E83F2
                                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,006E361A,?), ref: 006E844E
                                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 006E8487
                                                                                    • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 006E84CA
                                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 006E8501
                                                                                    • FreeLibrary.KERNEL32(?), ref: 006E850D
                                                                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 006E851D
                                                                                    • DestroyIcon.USER32(?), ref: 006E852C
                                                                                    • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 006E8549
                                                                                    • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 006E8555
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                                                    • String ID: .dll$.exe$.icl
                                                                                    • API String ID: 799131459-1154884017
                                                                                    • Opcode ID: d4cfa11198cb643f38eaf8f53f05fb61568beb5f2a2ac3e5488881f02bc06212
                                                                                    • Instruction ID: 6d5e262ab3c34228c4195a5bdbb85638832ea00b55f74cdb634f141d9930ab53
                                                                                    • Opcode Fuzzy Hash: d4cfa11198cb643f38eaf8f53f05fb61568beb5f2a2ac3e5488881f02bc06212
                                                                                    • Instruction Fuzzy Hash: A961DC71500345BEEB14CF65CC85BFE77AAAB04B21F104609F819EB1D1EF74AA91CBA0
                                                                                    Function 00657778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                                    • API String ID: 0-1645009161
                                                                                    • Opcode ID: d0f754d28143dbe1b47d1afeaa89ea95a05feaa8fb2a87590747a93136148292
                                                                                    • Instruction ID: 9854c9048fba95b0110b0115ff8530371ea161e9f94b5b82d7dac905ea48722f
                                                                                    • Opcode Fuzzy Hash: d0f754d28143dbe1b47d1afeaa89ea95a05feaa8fb2a87590747a93136148292
                                                                                    • Instruction Fuzzy Hash: FB811571640205BBDF21AF60EC42FEE37ABAF15301F144028FD09AB292EB70DA05C7A5
                                                                                    Function 006C3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CharLowerBuffW.USER32(?,?), ref: 006C3EF8
                                                                                    • _wcslen.LIBCMT ref: 006C3F03
                                                                                    • _wcslen.LIBCMT ref: 006C3F5A
                                                                                    • _wcslen.LIBCMT ref: 006C3F98
                                                                                    • GetDriveTypeW.KERNEL32(?), ref: 006C3FD6
                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006C401E
                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006C4059
                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006C4087
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                                                    • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                    • API String ID: 1839972693-4113822522
                                                                                    • Opcode ID: 101521348e59855a8f5e1516cc63f4a7a70740b78b8899489cce949fdac30c0e
                                                                                    • Instruction ID: 5f42fd6f4c26072302332331475579fee3fdcb7060a46dba7e721d00a06615b1
                                                                                    • Opcode Fuzzy Hash: 101521348e59855a8f5e1516cc63f4a7a70740b78b8899489cce949fdac30c0e
                                                                                    • Instruction Fuzzy Hash: 2C71DE726042119FC310EF28C8909BAB7F6EF94764F00892DF8A597391EB30ED49CB91
                                                                                    Function 006B5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadIconW.USER32(00000063), ref: 006B5A2E
                                                                                    • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 006B5A40
                                                                                    • SetWindowTextW.USER32(?,?), ref: 006B5A57
                                                                                    • GetDlgItem.USER32(?,000003EA), ref: 006B5A6C
                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 006B5A72
                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 006B5A82
                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 006B5A88
                                                                                    • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 006B5AA9
                                                                                    • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 006B5AC3
                                                                                    • GetWindowRect.USER32(?,?), ref: 006B5ACC
                                                                                    • _wcslen.LIBCMT ref: 006B5B33
                                                                                    • SetWindowTextW.USER32(?,?), ref: 006B5B6F
                                                                                    • GetDesktopWindow.USER32 ref: 006B5B75
                                                                                    • GetWindowRect.USER32(00000000), ref: 006B5B7C
                                                                                    • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 006B5BD3
                                                                                    • GetClientRect.USER32(?,?), ref: 006B5BE0
                                                                                    • PostMessageW.USER32(?,00000005,00000000,?), ref: 006B5C05
                                                                                    • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 006B5C2F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                                                    • String ID:
                                                                                    • API String ID: 895679908-0
                                                                                    • Opcode ID: ff249e0227ee3b66f1055c666adc0528b1be1cbaad21004780568509092e7721
                                                                                    • Instruction ID: 0bff869a902bd3a5b2355301210f1d23758f232b975fb099783bda8f0bc89107
                                                                                    • Opcode Fuzzy Hash: ff249e0227ee3b66f1055c666adc0528b1be1cbaad21004780568509092e7721
                                                                                    • Instruction Fuzzy Hash: CA718B71900B09AFDB20DFA8CE95BEEBBF6FF48714F104518E543A66A0D775A981CB10
                                                                                    Function 006CFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadCursorW.USER32(00000000,00007F89), ref: 006CFE27
                                                                                    • LoadCursorW.USER32(00000000,00007F8A), ref: 006CFE32
                                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 006CFE3D
                                                                                    • LoadCursorW.USER32(00000000,00007F03), ref: 006CFE48
                                                                                    • LoadCursorW.USER32(00000000,00007F8B), ref: 006CFE53
                                                                                    • LoadCursorW.USER32(00000000,00007F01), ref: 006CFE5E
                                                                                    • LoadCursorW.USER32(00000000,00007F81), ref: 006CFE69
                                                                                    • LoadCursorW.USER32(00000000,00007F88), ref: 006CFE74
                                                                                    • LoadCursorW.USER32(00000000,00007F80), ref: 006CFE7F
                                                                                    • LoadCursorW.USER32(00000000,00007F86), ref: 006CFE8A
                                                                                    • LoadCursorW.USER32(00000000,00007F83), ref: 006CFE95
                                                                                    • LoadCursorW.USER32(00000000,00007F85), ref: 006CFEA0
                                                                                    • LoadCursorW.USER32(00000000,00007F82), ref: 006CFEAB
                                                                                    • LoadCursorW.USER32(00000000,00007F84), ref: 006CFEB6
                                                                                    • LoadCursorW.USER32(00000000,00007F04), ref: 006CFEC1
                                                                                    • LoadCursorW.USER32(00000000,00007F02), ref: 006CFECC
                                                                                    • GetCursorInfo.USER32(?), ref: 006CFEDC
                                                                                    • GetLastError.KERNEL32 ref: 006CFF1E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Cursor$Load$ErrorInfoLast
                                                                                    • String ID:
                                                                                    • API String ID: 3215588206-0
                                                                                    • Opcode ID: 9f6a80a35fe660dabd25e73dcfd5b2e48e48a80293a3dcb272a9cc85c27c9f27
                                                                                    • Instruction ID: ca63e667af949a0932025b523839ad1df822c3b7f10815ef54a60d13cca58483
                                                                                    • Opcode Fuzzy Hash: 9f6a80a35fe660dabd25e73dcfd5b2e48e48a80293a3dcb272a9cc85c27c9f27
                                                                                    • Instruction Fuzzy Hash: 3C4154B0D043196ADB109FBA8C89D6EBFE9FF04364B50452EF11DEB281DB789901CE91
                                                                                    Function 006B30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen
                                                                                    • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[q
                                                                                    • API String ID: 176396367-3342603988
                                                                                    • Opcode ID: 81173c1aacaad059bce19ade1b8142fa74c6e26f7f79a8a075152e5cc7370394
                                                                                    • Instruction ID: 36869e84e17f18e599e1cba2122e2b15ede58fb9a9cf9fc00d4f275d8cfa3064
                                                                                    • Opcode Fuzzy Hash: 81173c1aacaad059bce19ade1b8142fa74c6e26f7f79a8a075152e5cc7370394
                                                                                    • Instruction Fuzzy Hash: 61E1A5B2B00536EBCB689F68C4516EEBBA6BF54710F548229E456A7340DB309FC98790
                                                                                    Function 006700C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 006700C6
                                                                                      • Part of subcall function 006700ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0072070C,00000FA0,22FD9D6D,?,?,?,?,006923B3,000000FF), ref: 0067011C
                                                                                      • Part of subcall function 006700ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,006923B3,000000FF), ref: 00670127
                                                                                      • Part of subcall function 006700ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,006923B3,000000FF), ref: 00670138
                                                                                      • Part of subcall function 006700ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0067014E
                                                                                      • Part of subcall function 006700ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0067015C
                                                                                      • Part of subcall function 006700ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0067016A
                                                                                      • Part of subcall function 006700ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00670195
                                                                                      • Part of subcall function 006700ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006701A0
                                                                                    • ___scrt_fastfail.LIBCMT ref: 006700E7
                                                                                      • Part of subcall function 006700A3: __onexit.LIBCMT ref: 006700A9
                                                                                    Strings
                                                                                    • kernel32.dll, xrefs: 00670133
                                                                                    • WakeAllConditionVariable, xrefs: 00670162
                                                                                    • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00670122
                                                                                    • InitializeConditionVariable, xrefs: 00670148
                                                                                    • SleepConditionVariableCS, xrefs: 00670154
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                                                    • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                    • API String ID: 66158676-1714406822
                                                                                    • Opcode ID: 193d76948bb072cd9b7db94133a3eabde6ea384f2db6b74fda37c315770a0fc3
                                                                                    • Instruction ID: a82cb76935703fba18849698122d8e0987cf562c89aeceae9e08b0dde6f9786b
                                                                                    • Opcode Fuzzy Hash: 193d76948bb072cd9b7db94133a3eabde6ea384f2db6b74fda37c315770a0fc3
                                                                                    • Instruction Fuzzy Hash: 69212972641750EBFB205BB4AC45BAA3797DF44B60F118139F805967D1DB7498008AB4
                                                                                    Function 006C44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CharLowerBuffW.USER32(00000000,00000000,006ECC08), ref: 006C4527
                                                                                    • _wcslen.LIBCMT ref: 006C453B
                                                                                    • _wcslen.LIBCMT ref: 006C4599
                                                                                    • _wcslen.LIBCMT ref: 006C45F4
                                                                                    • _wcslen.LIBCMT ref: 006C463F
                                                                                    • _wcslen.LIBCMT ref: 006C46A7
                                                                                      • Part of subcall function 0066F9F2: _wcslen.LIBCMT ref: 0066F9FD
                                                                                    • GetDriveTypeW.KERNEL32(?,00716BF0,00000061), ref: 006C4743
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$BuffCharDriveLowerType
                                                                                    • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                    • API String ID: 2055661098-1000479233
                                                                                    • Opcode ID: 299820f5263e7a48db6a09026ad1b7256bd32207a78ea1157a3ea05c9871c996
                                                                                    • Instruction ID: a73d681416c27bba04f65d4e8eadbacf7a3da1fdd3602caef586d93d026e1cb2
                                                                                    • Opcode Fuzzy Hash: 299820f5263e7a48db6a09026ad1b7256bd32207a78ea1157a3ea05c9871c996
                                                                                    • Instruction Fuzzy Hash: 6CB1D0716083029BC710DF29C8A0EBAB7E6EFA5760F50491DF49687395EB30D845CAA2
                                                                                    Function 006E911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00669BB2
                                                                                    • DragQueryPoint.SHELL32(?,?), ref: 006E9147
                                                                                      • Part of subcall function 006E7674: ClientToScreen.USER32(?,?), ref: 006E769A
                                                                                      • Part of subcall function 006E7674: GetWindowRect.USER32(?,?), ref: 006E7710
                                                                                      • Part of subcall function 006E7674: PtInRect.USER32(?,?,006E8B89), ref: 006E7720
                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 006E91B0
                                                                                    • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 006E91BB
                                                                                    • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 006E91DE
                                                                                    • SendMessageW.USER32(?,000000C2,00000001,?), ref: 006E9225
                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 006E923E
                                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 006E9255
                                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 006E9277
                                                                                    • DragFinish.SHELL32(?), ref: 006E927E
                                                                                    • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 006E9371
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                                                    • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#r
                                                                                    • API String ID: 221274066-3460447309
                                                                                    • Opcode ID: 1e477585061028222fada3701d692a0b30f08c37f1966e559882e4fc767f9f8d
                                                                                    • Instruction ID: 115a3713ddbc2eb5db76134108288a0a3ac484f0723f82af069ece5a23dc8745
                                                                                    • Opcode Fuzzy Hash: 1e477585061028222fada3701d692a0b30f08c37f1966e559882e4fc767f9f8d
                                                                                    • Instruction Fuzzy Hash: 64618A71108341AFC701DF64DC85DAFBBEAEF89760F40092DF991961A1DB309A4ACB66
                                                                                    Function 006DAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _wcslen.LIBCMT ref: 006DB198
                                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006DB1B0
                                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006DB1D4
                                                                                    • _wcslen.LIBCMT ref: 006DB200
                                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006DB214
                                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006DB236
                                                                                    • _wcslen.LIBCMT ref: 006DB332
                                                                                      • Part of subcall function 006C05A7: GetStdHandle.KERNEL32(000000F6), ref: 006C05C6
                                                                                    • _wcslen.LIBCMT ref: 006DB34B
                                                                                    • _wcslen.LIBCMT ref: 006DB366
                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006DB3B6
                                                                                    • GetLastError.KERNEL32(00000000), ref: 006DB407
                                                                                    • CloseHandle.KERNEL32(?), ref: 006DB439
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006DB44A
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006DB45C
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006DB46E
                                                                                    • CloseHandle.KERNEL32(?), ref: 006DB4E3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                                                    • String ID:
                                                                                    • API String ID: 2178637699-0
                                                                                    • Opcode ID: 988ff00561503dc6784313311294d69c0f10d72408016fa2e93a187bbf34b79e
                                                                                    • Instruction ID: 4da7da99eef6cc3896d76175493853e5cd722bb424db059ba53106c50f5a72ca
                                                                                    • Opcode Fuzzy Hash: 988ff00561503dc6784313311294d69c0f10d72408016fa2e93a187bbf34b79e
                                                                                    • Instruction Fuzzy Hash: C4F18931908340DFC754EF24C891B6ABBE2AF85314F15845EF8998B3A6DB31EC45CB96
                                                                                    Function 006D3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,006ECC08), ref: 006D40BB
                                                                                    • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 006D40CD
                                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,006ECC08), ref: 006D40F2
                                                                                    • FreeLibrary.KERNEL32(00000000,?,006ECC08), ref: 006D413E
                                                                                    • StringFromGUID2.OLE32(?,?,00000028,?,006ECC08), ref: 006D41A8
                                                                                    • SysFreeString.OLEAUT32(00000009), ref: 006D4262
                                                                                    • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 006D42C8
                                                                                    • SysFreeString.OLEAUT32(?), ref: 006D42F2
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                                                    • String ID: GetModuleHandleExW$kernel32.dll
                                                                                    • API String ID: 354098117-199464113
                                                                                    • Opcode ID: 799cd9645e2119099760b1cb13e99baff851b8a5321471e928e2325f6a525a0c
                                                                                    • Instruction ID: 17f9f723c324818f8860ed6a95bcf067dad91b55ea4ed40eb0d11945e69736fa
                                                                                    • Opcode Fuzzy Hash: 799cd9645e2119099760b1cb13e99baff851b8a5321471e928e2325f6a525a0c
                                                                                    • Instruction Fuzzy Hash: 50121975A00215EFDB14DF94C884EAEBBB6FF85314F248099E9059B351DB31ED86CBA0
                                                                                    Function 0065326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetMenuItemCount.USER32(00721990), ref: 00692F8D
                                                                                    • GetMenuItemCount.USER32(00721990), ref: 0069303D
                                                                                    • GetCursorPos.USER32(?), ref: 00693081
                                                                                    • SetForegroundWindow.USER32(00000000), ref: 0069308A
                                                                                    • TrackPopupMenuEx.USER32(00721990,00000000,?,00000000,00000000,00000000), ref: 0069309D
                                                                                    • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006930A9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                                                    • String ID: 0
                                                                                    • API String ID: 36266755-4108050209
                                                                                    • Opcode ID: a53f72ddb08ffa2f89a24f84f65f31bd77cbbe7e45f506af4b8cc468c7313d9b
                                                                                    • Instruction ID: 1b8062a4013a6b39eae66b9daf8260d11181d43685d2d0fbaf4eb40a8ef8d1ba
                                                                                    • Opcode Fuzzy Hash: a53f72ddb08ffa2f89a24f84f65f31bd77cbbe7e45f506af4b8cc468c7313d9b
                                                                                    • Instruction Fuzzy Hash: 02710970640216BEEF218F64CC99FEABF6AFF04764F204216F9146A7E0C7B1A954CB54
                                                                                    Function 006E6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DestroyWindow.USER32(00000000,?), ref: 006E6DEB
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 006E6E5F
                                                                                    • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 006E6E81
                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006E6E94
                                                                                    • DestroyWindow.USER32(?), ref: 006E6EB5
                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00650000,00000000), ref: 006E6EE4
                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006E6EFD
                                                                                    • GetDesktopWindow.USER32 ref: 006E6F16
                                                                                    • GetWindowRect.USER32(00000000), ref: 006E6F1D
                                                                                    • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 006E6F35
                                                                                    • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 006E6F4D
                                                                                      • Part of subcall function 00669944: GetWindowLongW.USER32(?,000000EB), ref: 00669952
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                                                    • String ID: 0$tooltips_class32
                                                                                    • API String ID: 2429346358-3619404913
                                                                                    • Opcode ID: bfb28bf497603b5a9261823d21128f102c59347a3b6cd370edc33a374a15d97b
                                                                                    • Instruction ID: 02a495b6670774fe98a3a9375b0870360a1d27f32995c4b7082718a7ca3a2b86
                                                                                    • Opcode Fuzzy Hash: bfb28bf497603b5a9261823d21128f102c59347a3b6cd370edc33a374a15d97b
                                                                                    • Instruction Fuzzy Hash: 3C717670104384AFDB21CF19D884AAABBFAFBA9340F44441DF999872A1C770AD4ACB15
                                                                                    Function 006CC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006CC4B0
                                                                                    • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 006CC4C3
                                                                                    • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 006CC4D7
                                                                                    • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 006CC4F0
                                                                                    • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 006CC533
                                                                                    • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 006CC549
                                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006CC554
                                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006CC584
                                                                                    • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 006CC5DC
                                                                                    • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 006CC5F0
                                                                                    • InternetCloseHandle.WININET(00000000), ref: 006CC5FB
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                                                    • String ID:
                                                                                    • API String ID: 3800310941-3916222277
                                                                                    • Opcode ID: 2a32de8e4020a0ebfafaeca01be8df816468ae936e98202380d24b804adfe7d2
                                                                                    • Instruction ID: 60b4450cf1618c74f625907467ebebcbd37fd67d6a2aabb729fa8ad1ac5854c0
                                                                                    • Opcode Fuzzy Hash: 2a32de8e4020a0ebfafaeca01be8df816468ae936e98202380d24b804adfe7d2
                                                                                    • Instruction Fuzzy Hash: 63513AB1500748BFDB218F64C988FBA7BFEEF08764F40841DF94A96250DB34EA559B60
                                                                                    Function 006E856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 006E8592
                                                                                    • GetFileSize.KERNEL32(00000000,00000000), ref: 006E85A2
                                                                                    • GlobalAlloc.KERNEL32(00000002,00000000), ref: 006E85AD
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006E85BA
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 006E85C8
                                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 006E85D7
                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 006E85E0
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006E85E7
                                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 006E85F8
                                                                                    • OleLoadPicture.OLEAUT32(?,00000000,00000000,006EFC38,?), ref: 006E8611
                                                                                    • GlobalFree.KERNEL32(00000000), ref: 006E8621
                                                                                    • GetObjectW.GDI32(?,00000018,000000FF), ref: 006E8641
                                                                                    • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 006E8671
                                                                                    • DeleteObject.GDI32(00000000), ref: 006E8699
                                                                                    • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 006E86AF
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                    • String ID:
                                                                                    • API String ID: 3840717409-0
                                                                                    • Opcode ID: 7b40ffc9c82ce33378bbd678c57e00de97b7b36854e842ea42575e6ff51ba442
                                                                                    • Instruction ID: f2749bf0c188c7cf571bb11d8b36c8f779f3bb549165ca432703a95d8cfd0815
                                                                                    • Opcode Fuzzy Hash: 7b40ffc9c82ce33378bbd678c57e00de97b7b36854e842ea42575e6ff51ba442
                                                                                    • Instruction Fuzzy Hash: B741FC75601344AFDB11DFA5DC88EAB7BBAEF89725F104058F919EB250DB309902DB60
                                                                                    Function 006C14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VariantInit.OLEAUT32(00000000), ref: 006C1502
                                                                                    • VariantCopy.OLEAUT32(?,?), ref: 006C150B
                                                                                    • VariantClear.OLEAUT32(?), ref: 006C1517
                                                                                    • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 006C15FB
                                                                                    • VarR8FromDec.OLEAUT32(?,?), ref: 006C1657
                                                                                    • VariantInit.OLEAUT32(?), ref: 006C1708
                                                                                    • SysFreeString.OLEAUT32(?), ref: 006C178C
                                                                                    • VariantClear.OLEAUT32(?), ref: 006C17D8
                                                                                    • VariantClear.OLEAUT32(?), ref: 006C17E7
                                                                                    • VariantInit.OLEAUT32(00000000), ref: 006C1823
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                                                                    • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                                    • API String ID: 1234038744-3931177956
                                                                                    • Opcode ID: 3f497900c5478b56ee967643662ef50f68ea585237780f9bbe1456c600c37db3
                                                                                    • Instruction ID: b05bf779a3d70dc3c471e1ab4e167c9527d6cfb9fe9e10a1e71624949881a3ae
                                                                                    • Opcode Fuzzy Hash: 3f497900c5478b56ee967643662ef50f68ea585237780f9bbe1456c600c37db3
                                                                                    • Instruction Fuzzy Hash: 4CD1AFB1600215DBDB109F65D885FB9B7B7FF47700F94805EE806AF282DB30A946DBA1
                                                                                    Function 006DB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006DC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006DB6AE,?,?), ref: 006DC9B5
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DC9F1
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DCA68
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DCA9E
                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006DB6F4
                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006DB772
                                                                                    • RegDeleteValueW.ADVAPI32(?,?), ref: 006DB80A
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 006DB87E
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 006DB89C
                                                                                    • LoadLibraryA.KERNEL32(advapi32.dll), ref: 006DB8F2
                                                                                    • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 006DB904
                                                                                    • RegDeleteKeyW.ADVAPI32(?,?), ref: 006DB922
                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 006DB983
                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 006DB994
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                                                    • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                    • API String ID: 146587525-4033151799
                                                                                    • Opcode ID: 0ba493ac626576f98028c66de9dac8b472f2ed0e3b2a7dedc8c97f30bb735b2b
                                                                                    • Instruction ID: b4b3307ac1f4d3583b0cd1d10ba1b36cd5e0b4fc8242b603afa529d449cb8206
                                                                                    • Opcode Fuzzy Hash: 0ba493ac626576f98028c66de9dac8b472f2ed0e3b2a7dedc8c97f30bb735b2b
                                                                                    • Instruction Fuzzy Hash: 56C18B30604241EFD714DF24C494F6ABBE6BF84318F15955DF89A8B3A2CB31E84ACB91
                                                                                    Function 006D255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetDC.USER32(00000000), ref: 006D25D8
                                                                                    • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 006D25E8
                                                                                    • CreateCompatibleDC.GDI32(?), ref: 006D25F4
                                                                                    • SelectObject.GDI32(00000000,?), ref: 006D2601
                                                                                    • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 006D266D
                                                                                    • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 006D26AC
                                                                                    • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 006D26D0
                                                                                    • SelectObject.GDI32(?,?), ref: 006D26D8
                                                                                    • DeleteObject.GDI32(?), ref: 006D26E1
                                                                                    • DeleteDC.GDI32(?), ref: 006D26E8
                                                                                    • ReleaseDC.USER32(00000000,?), ref: 006D26F3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                                    • String ID: (
                                                                                    • API String ID: 2598888154-3887548279
                                                                                    • Opcode ID: 1e5c381e52d16c7d625610d5457f9a52f974bb0ed590a228b3ef7cff9257a38f
                                                                                    • Instruction ID: 70427d044faee3e4db851f7937a375116008476309fc8459655cde1e40b77731
                                                                                    • Opcode Fuzzy Hash: 1e5c381e52d16c7d625610d5457f9a52f974bb0ed590a228b3ef7cff9257a38f
                                                                                    • Instruction Fuzzy Hash: 1861F175D00219EFCF04CFA8D884AAEBBB6FF48310F20852AE955A7350D771A941CFA4
                                                                                    Function 0068DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___free_lconv_mon.LIBCMT ref: 0068DAA1
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D659
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D66B
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D67D
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D68F
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D6A1
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D6B3
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D6C5
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D6D7
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D6E9
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D6FB
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D70D
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D71F
                                                                                      • Part of subcall function 0068D63C: _free.LIBCMT ref: 0068D731
                                                                                    • _free.LIBCMT ref: 0068DA96
                                                                                      • Part of subcall function 006829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000), ref: 006829DE
                                                                                      • Part of subcall function 006829C8: GetLastError.KERNEL32(00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000,00000000), ref: 006829F0
                                                                                    • _free.LIBCMT ref: 0068DAB8
                                                                                    • _free.LIBCMT ref: 0068DACD
                                                                                    • _free.LIBCMT ref: 0068DAD8
                                                                                    • _free.LIBCMT ref: 0068DAFA
                                                                                    • _free.LIBCMT ref: 0068DB0D
                                                                                    • _free.LIBCMT ref: 0068DB1B
                                                                                    • _free.LIBCMT ref: 0068DB26
                                                                                    • _free.LIBCMT ref: 0068DB5E
                                                                                    • _free.LIBCMT ref: 0068DB65
                                                                                    • _free.LIBCMT ref: 0068DB82
                                                                                    • _free.LIBCMT ref: 0068DB9A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                    • String ID:
                                                                                    • API String ID: 161543041-0
                                                                                    • Opcode ID: 7dca7de39729de8b76cd56806726fb31f4af48a80fc6c57fab1cafca3ac8fbd6
                                                                                    • Instruction ID: 1b94c7e86f7fca61715171181bba7935768ea0adc9e4f1e5d3166bad2d914ebf
                                                                                    • Opcode Fuzzy Hash: 7dca7de39729de8b76cd56806726fb31f4af48a80fc6c57fab1cafca3ac8fbd6
                                                                                    • Instruction Fuzzy Hash: AB315C716442069FEB65BA3AE845B9A77EAFF00720F21462DE448D72D1DE34EC808734
                                                                                    Function 006B365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 006B369C
                                                                                    • _wcslen.LIBCMT ref: 006B36A7
                                                                                    • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 006B3797
                                                                                    • GetClassNameW.USER32(?,?,00000400), ref: 006B380C
                                                                                    • GetDlgCtrlID.USER32(?), ref: 006B385D
                                                                                    • GetWindowRect.USER32(?,?), ref: 006B3882
                                                                                    • GetParent.USER32(?), ref: 006B38A0
                                                                                    • ScreenToClient.USER32(00000000), ref: 006B38A7
                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 006B3921
                                                                                    • GetWindowTextW.USER32(?,?,00000400), ref: 006B395D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                                                                    • String ID: %s%u
                                                                                    • API String ID: 4010501982-679674701
                                                                                    • Opcode ID: 3d2de20251e9633db36df1f6251d2d96d4a436fcb9efab636fab8b70cf0e7f5b
                                                                                    • Instruction ID: 42149437ea08043fb771e4d644f4be17ee0fa7e7ffa0b93c37362a401de7ed31
                                                                                    • Opcode Fuzzy Hash: 3d2de20251e9633db36df1f6251d2d96d4a436fcb9efab636fab8b70cf0e7f5b
                                                                                    • Instruction Fuzzy Hash: A391A5B1304716AFD715DF24C885FEAB7AAFF44350F008529F999C6290EB30EA85CB91
                                                                                    Function 006B4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetClassNameW.USER32(?,?,00000400), ref: 006B4994
                                                                                    • GetWindowTextW.USER32(?,?,00000400), ref: 006B49DA
                                                                                    • _wcslen.LIBCMT ref: 006B49EB
                                                                                    • CharUpperBuffW.USER32(?,00000000), ref: 006B49F7
                                                                                    • _wcsstr.LIBVCRUNTIME ref: 006B4A2C
                                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 006B4A64
                                                                                    • GetWindowTextW.USER32(?,?,00000400), ref: 006B4A9D
                                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 006B4AE6
                                                                                    • GetClassNameW.USER32(?,?,00000400), ref: 006B4B20
                                                                                    • GetWindowRect.USER32(?,?), ref: 006B4B8B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                                                    • String ID: ThumbnailClass
                                                                                    • API String ID: 1311036022-1241985126
                                                                                    • Opcode ID: f6a296983b1922a0c49cf819e5382b691a0ddfbf24c4f8dc398e2eaf579359d7
                                                                                    • Instruction ID: 00095baaa8c0b44f5fe76fa4d427a9a0f11e32449583a4cfd225192ead98e140
                                                                                    • Opcode Fuzzy Hash: f6a296983b1922a0c49cf819e5382b691a0ddfbf24c4f8dc398e2eaf579359d7
                                                                                    • Instruction Fuzzy Hash: 49918DB11043059BDB04DF14C985BEA7BEAFF84714F048469FE859A296DF30ED86CBA1
                                                                                    Function 006BBF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetMenuItemInfoW.USER32(00721990,000000FF,00000000,00000030), ref: 006BBFAC
                                                                                    • SetMenuItemInfoW.USER32(00721990,00000004,00000000,00000030), ref: 006BBFE1
                                                                                    • Sleep.KERNEL32(000001F4), ref: 006BBFF3
                                                                                    • GetMenuItemCount.USER32(?), ref: 006BC039
                                                                                    • GetMenuItemID.USER32(?,00000000), ref: 006BC056
                                                                                    • GetMenuItemID.USER32(?,-00000001), ref: 006BC082
                                                                                    • GetMenuItemID.USER32(?,?), ref: 006BC0C9
                                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 006BC10F
                                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006BC124
                                                                                    • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006BC145
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                                                    • String ID: 0
                                                                                    • API String ID: 1460738036-4108050209
                                                                                    • Opcode ID: 689e485ad28a34f3b12a497bba494e08b15594b05d6a24314da02c82505b8688
                                                                                    • Instruction ID: c83109a339ec2430b21bda8533bb55d72ab750cd3e4365fc5d1d7e90c70dae49
                                                                                    • Opcode Fuzzy Hash: 689e485ad28a34f3b12a497bba494e08b15594b05d6a24314da02c82505b8688
                                                                                    • Instruction Fuzzy Hash: DF6181F0900346AFDF11DF68CC88AFE7BBAEB05364F004059E951A7292C775AE95CB61
                                                                                    Function 006DCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 006DCC64
                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 006DCC8D
                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 006DCD48
                                                                                      • Part of subcall function 006DCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 006DCCAA
                                                                                      • Part of subcall function 006DCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 006DCCBD
                                                                                      • Part of subcall function 006DCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 006DCCCF
                                                                                      • Part of subcall function 006DCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 006DCD05
                                                                                      • Part of subcall function 006DCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 006DCD28
                                                                                    • RegDeleteKeyW.ADVAPI32(?,?), ref: 006DCCF3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                                                    • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                    • API String ID: 2734957052-4033151799
                                                                                    • Opcode ID: 663f98d2bd93f46f365f360ef14c0bfda11499416c980c11a4154810c9853d66
                                                                                    • Instruction ID: 8cb48cedb0f3b0e42702e6d9059508ab9c09e278db1e77458499fdf31fe05360
                                                                                    • Opcode Fuzzy Hash: 663f98d2bd93f46f365f360ef14c0bfda11499416c980c11a4154810c9853d66
                                                                                    • Instruction Fuzzy Hash: EF316E71D0122EBBDB208B55DC88EFFBB7EEF45764F000166F905E6340DA349A46DAA0
                                                                                    Function 006C3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 006C3D40
                                                                                    • _wcslen.LIBCMT ref: 006C3D6D
                                                                                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 006C3D9D
                                                                                    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 006C3DBE
                                                                                    • RemoveDirectoryW.KERNEL32(?), ref: 006C3DCE
                                                                                    • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 006C3E55
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006C3E60
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006C3E6B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                                                    • String ID: :$\$\??\%s
                                                                                    • API String ID: 1149970189-3457252023
                                                                                    • Opcode ID: dac0a85a1fa833677c0896761b613f6d03eb426803f04f8d8d102c65b3c5a480
                                                                                    • Instruction ID: 31fd2601945e19ad69451ab739576d24758222ce62a49018b73bbadd20b60ba1
                                                                                    • Opcode Fuzzy Hash: dac0a85a1fa833677c0896761b613f6d03eb426803f04f8d8d102c65b3c5a480
                                                                                    • Instruction Fuzzy Hash: 7E31A371900259ABDB209FA0DC89FEF37BEEF89710F1081A9F609D6250EB7497458B24
                                                                                    Function 006BE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • timeGetTime.WINMM ref: 006BE6B4
                                                                                      • Part of subcall function 0066E551: timeGetTime.WINMM(?,?,006BE6D4), ref: 0066E555
                                                                                    • Sleep.KERNEL32(0000000A), ref: 006BE6E1
                                                                                    • EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 006BE705
                                                                                    • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 006BE727
                                                                                    • SetActiveWindow.USER32 ref: 006BE746
                                                                                    • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 006BE754
                                                                                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 006BE773
                                                                                    • Sleep.KERNEL32(000000FA), ref: 006BE77E
                                                                                    • IsWindow.USER32 ref: 006BE78A
                                                                                    • EndDialog.USER32(00000000), ref: 006BE79B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                                    • String ID: BUTTON
                                                                                    • API String ID: 1194449130-3405671355
                                                                                    • Opcode ID: ba64ac5c6eb47800aa1ea3cebcfcd5ad7a11cef4e0b62ce5b17a9fcb78949c90
                                                                                    • Instruction ID: c02a2db68264ccba5af67e44657518b315ad75dc399221cbb37f36084a210916
                                                                                    • Opcode Fuzzy Hash: ba64ac5c6eb47800aa1ea3cebcfcd5ad7a11cef4e0b62ce5b17a9fcb78949c90
                                                                                    • Instruction Fuzzy Hash: B02150B1340344BFEB205F20ECC9AE63B6BBB55358B106424F815956A2DB76EC479B28
                                                                                    Function 006BE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 006BEA5D
                                                                                    • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 006BEA73
                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006BEA84
                                                                                    • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 006BEA96
                                                                                    • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 006BEAA7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: SendString$_wcslen
                                                                                    • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                    • API String ID: 2420728520-1007645807
                                                                                    • Opcode ID: c0e141a38d2c1d8a0a0b8493fb7a2809a98f4ee36ffddf57809f46b129b60dba
                                                                                    • Instruction ID: a26dc3c4bfcfd83c998bac144b0ec1046f1e3593ef8f17c70f98b4902938e5ce
                                                                                    • Opcode Fuzzy Hash: c0e141a38d2c1d8a0a0b8493fb7a2809a98f4ee36ffddf57809f46b129b60dba
                                                                                    • Instruction Fuzzy Hash: 8A1182B1A902697AD720A7A5DC4ADFF6B7DEFD1F40F40042DB811A20D1EEB41D89C6B0
                                                                                    Function 006B5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetDlgItem.USER32(?,00000001), ref: 006B5CE2
                                                                                    • GetWindowRect.USER32(00000000,?), ref: 006B5CFB
                                                                                    • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 006B5D59
                                                                                    • GetDlgItem.USER32(?,00000002), ref: 006B5D69
                                                                                    • GetWindowRect.USER32(00000000,?), ref: 006B5D7B
                                                                                    • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 006B5DCF
                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 006B5DDD
                                                                                    • GetWindowRect.USER32(00000000,?), ref: 006B5DEF
                                                                                    • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 006B5E31
                                                                                    • GetDlgItem.USER32(?,000003EA), ref: 006B5E44
                                                                                    • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 006B5E5A
                                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 006B5E67
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$ItemMoveRect$Invalidate
                                                                                    • String ID:
                                                                                    • API String ID: 3096461208-0
                                                                                    • Opcode ID: 6d313f632198790d537b97255f39d2dbccd2c1ede5a5a58e4240901ef6362942
                                                                                    • Instruction ID: ad39ff11da20d2c667108ee2e0fdf788571818be96649216700c2f0f3098af68
                                                                                    • Opcode Fuzzy Hash: 6d313f632198790d537b97255f39d2dbccd2c1ede5a5a58e4240901ef6362942
                                                                                    • Instruction Fuzzy Hash: F7510DB0A00715AFDF18CF68CD99AEE7BB6AF48310F148229F916E7290D7709E418B50
                                                                                    Function 00668BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00668F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00668BE8,?,00000000,?,?,?,?,00668BBA,00000000,?), ref: 00668FC5
                                                                                    • DestroyWindow.USER32(?), ref: 00668C81
                                                                                    • KillTimer.USER32(00000000,?,?,?,?,00668BBA,00000000,?), ref: 00668D1B
                                                                                    • DestroyAcceleratorTable.USER32(00000000), ref: 006A6973
                                                                                    • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00668BBA,00000000,?), ref: 006A69A1
                                                                                    • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00668BBA,00000000,?), ref: 006A69B8
                                                                                    • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00668BBA,00000000), ref: 006A69D4
                                                                                    • DeleteObject.GDI32(00000000), ref: 006A69E6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                                    • String ID:
                                                                                    • API String ID: 641708696-0
                                                                                    • Opcode ID: e0c4351073478a8213359ef466746b08eda6025564bdbbc6bfed97f7b4aaa582
                                                                                    • Instruction ID: eddff14ef2ac4f1c362657b5531bd52657147baad6c800bbc85ef829af68a4f7
                                                                                    • Opcode Fuzzy Hash: e0c4351073478a8213359ef466746b08eda6025564bdbbc6bfed97f7b4aaa582
                                                                                    • Instruction Fuzzy Hash: A9619A31102740DFCB359F24C998B6677B3FB55322F58961CE0829B660CB35AC92CFA4
                                                                                    Function 00669838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669944: GetWindowLongW.USER32(?,000000EB), ref: 00669952
                                                                                    • GetSysColor.USER32(0000000F), ref: 00669862
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ColorLongWindow
                                                                                    • String ID:
                                                                                    • API String ID: 259745315-0
                                                                                    • Opcode ID: d8876057bf905c8501932faadb177efb5459ff69f4fdc13b6e23f53b781618a4
                                                                                    • Instruction ID: 67ec78bf530759793eb0192a88d367c7891c02f934e2cef3040617cac94593b1
                                                                                    • Opcode Fuzzy Hash: d8876057bf905c8501932faadb177efb5459ff69f4fdc13b6e23f53b781618a4
                                                                                    • Instruction Fuzzy Hash: 26417F315047449FDB205F389C88BF93BABAB56371F144A59FDA28B2E1D6319C42DB20
                                                                                    Function 00688D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: .g
                                                                                    • API String ID: 0-2054203957
                                                                                    • Opcode ID: dd6ad19b5acd9a37f1d01901210e2f833b032564046d301c7589e707ddbf951f
                                                                                    • Instruction ID: ba992429c3dc41ef0d86f74d2a6dac98a19d770687ba395b8ba6a272bd925e6d
                                                                                    • Opcode Fuzzy Hash: dd6ad19b5acd9a37f1d01901210e2f833b032564046d301c7589e707ddbf951f
                                                                                    • Instruction Fuzzy Hash: C2C1C374904249AFDB21EFE8C845BFDBBB2AF09310F18429DE515A7392C7349942CB75
                                                                                    Function 006B96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0069F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 006B9717
                                                                                    • LoadStringW.USER32(00000000,?,0069F7F8,00000001), ref: 006B9720
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0069F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 006B9742
                                                                                    • LoadStringW.USER32(00000000,?,0069F7F8,00000001), ref: 006B9745
                                                                                    • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 006B9866
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: HandleLoadModuleString$Message_wcslen
                                                                                    • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                                    • API String ID: 747408836-2268648507
                                                                                    • Opcode ID: 3867e6846556d4bd252c5f43ce06cead8fecb2533e7bc0517629ba217e667741
                                                                                    • Instruction ID: 8443bee71c4e3dae157a5e593585029862936286509e3afa03452bb9287078de
                                                                                    • Opcode Fuzzy Hash: 3867e6846556d4bd252c5f43ce06cead8fecb2533e7bc0517629ba217e667741
                                                                                    • Instruction Fuzzy Hash: C2416FB2800219AACF44EBE0CD82DEE777AAF15741F600469FA0572192EB356F49CB75
                                                                                    Function 006B06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                    • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 006B07A2
                                                                                    • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 006B07BE
                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 006B07DA
                                                                                    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 006B0804
                                                                                    • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 006B082C
                                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006B0837
                                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006B083C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                                                    • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                    • API String ID: 323675364-22481851
                                                                                    • Opcode ID: 9d08a90c6a5e143840dddcc8080edf66304ac1a24f4f0b21113f6312dbc4dcfd
                                                                                    • Instruction ID: 39a0df872840b0168b505fc605496707c313e3c83ff06119ae408fb973703dd6
                                                                                    • Opcode Fuzzy Hash: 9d08a90c6a5e143840dddcc8080edf66304ac1a24f4f0b21113f6312dbc4dcfd
                                                                                    • Instruction Fuzzy Hash: E7410AB1C10229EBDF15EB94DC958EEB77AFF44750F044129F901A72A1EB305E49CBA0
                                                                                    Function 006D3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VariantInit.OLEAUT32(?), ref: 006D3C5C
                                                                                    • CoInitialize.OLE32(00000000), ref: 006D3C8A
                                                                                    • CoUninitialize.OLE32 ref: 006D3C94
                                                                                    • _wcslen.LIBCMT ref: 006D3D2D
                                                                                    • GetRunningObjectTable.OLE32(00000000,?), ref: 006D3DB1
                                                                                    • SetErrorMode.KERNEL32(00000001,00000029), ref: 006D3ED5
                                                                                    • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 006D3F0E
                                                                                    • CoGetObject.OLE32(?,00000000,006EFB98,?), ref: 006D3F2D
                                                                                    • SetErrorMode.KERNEL32(00000000), ref: 006D3F40
                                                                                    • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 006D3FC4
                                                                                    • VariantClear.OLEAUT32(?), ref: 006D3FD8
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                                                    • String ID:
                                                                                    • API String ID: 429561992-0
                                                                                    • Opcode ID: 637da1ae604d7dd6b231a39334b96d3ba027e5c6942ea4a03adb0d1c8c3c66a6
                                                                                    • Instruction ID: 683d9dd1004aa69329b66af9258b367a420ae725af4b6a30c7917b00bec78aee
                                                                                    • Opcode Fuzzy Hash: 637da1ae604d7dd6b231a39334b96d3ba027e5c6942ea4a03adb0d1c8c3c66a6
                                                                                    • Instruction Fuzzy Hash: 8DC11371A083159FD700DF68C88496BBBEAAF89744F14491EF9899B351DB30EE06CB52
                                                                                    Function 006C7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CoInitialize.OLE32(00000000), ref: 006C7AF3
                                                                                    • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 006C7B8F
                                                                                    • SHGetDesktopFolder.SHELL32(?), ref: 006C7BA3
                                                                                    • CoCreateInstance.OLE32(006EFD08,00000000,00000001,00716E6C,?), ref: 006C7BEF
                                                                                    • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 006C7C74
                                                                                    • CoTaskMemFree.OLE32(?,?), ref: 006C7CCC
                                                                                    • SHBrowseForFolderW.SHELL32(?), ref: 006C7D57
                                                                                    • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 006C7D7A
                                                                                    • CoTaskMemFree.OLE32(00000000), ref: 006C7D81
                                                                                    • CoTaskMemFree.OLE32(00000000), ref: 006C7DD6
                                                                                    • CoUninitialize.OLE32 ref: 006C7DDC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                                                    • String ID:
                                                                                    • API String ID: 2762341140-0
                                                                                    • Opcode ID: ec160cae6d172cba365b1e3cbd88eec477d60ddc3df480d59391c1f2aa35f516
                                                                                    • Instruction ID: 80b320b1f89d62d3a09eba4934982fd59cd91aec0974da1f8fd5157900d8c27f
                                                                                    • Opcode Fuzzy Hash: ec160cae6d172cba365b1e3cbd88eec477d60ddc3df480d59391c1f2aa35f516
                                                                                    • Instruction Fuzzy Hash: F6C1E975A04209AFCB14DFA4C884DAEBBBAFF48315F148499E81A9B361D730ED45CF94
                                                                                    Function 006E541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 006E5504
                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006E5515
                                                                                    • CharNextW.USER32(00000158), ref: 006E5544
                                                                                    • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 006E5585
                                                                                    • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 006E559B
                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006E55AC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$CharNext
                                                                                    • String ID:
                                                                                    • API String ID: 1350042424-0
                                                                                    • Opcode ID: da528e7ef3f26b8559d901d68f0f5ee8bb5a40d676b985e31e1114f97c0bbeac
                                                                                    • Instruction ID: 08b08a389a48b47e6613c5c5d9aa2891621dfcb7f456f93500133c88ce98c00f
                                                                                    • Opcode Fuzzy Hash: da528e7ef3f26b8559d901d68f0f5ee8bb5a40d676b985e31e1114f97c0bbeac
                                                                                    • Instruction Fuzzy Hash: DB619030902789EFDF109F56CC849FE7BBAEB05728F104145F926AB291D7748A82DB61
                                                                                    Function 006AFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 006AFAAF
                                                                                    • SafeArrayAllocData.OLEAUT32(?), ref: 006AFB08
                                                                                    • VariantInit.OLEAUT32(?), ref: 006AFB1A
                                                                                    • SafeArrayAccessData.OLEAUT32(?,?), ref: 006AFB3A
                                                                                    • VariantCopy.OLEAUT32(?,?), ref: 006AFB8D
                                                                                    • SafeArrayUnaccessData.OLEAUT32(?), ref: 006AFBA1
                                                                                    • VariantClear.OLEAUT32(?), ref: 006AFBB6
                                                                                    • SafeArrayDestroyData.OLEAUT32(?), ref: 006AFBC3
                                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006AFBCC
                                                                                    • VariantClear.OLEAUT32(?), ref: 006AFBDE
                                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006AFBE9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                                    • String ID:
                                                                                    • API String ID: 2706829360-0
                                                                                    • Opcode ID: 3cf9e71ee673e3e1343126a1a2c3639447f38fae6c761f50b2fd193ba0e68d7a
                                                                                    • Instruction ID: 92896541e80692b30bd111c05929e5f2833638e7cd5321740b2a7142ac9c1e68
                                                                                    • Opcode Fuzzy Hash: 3cf9e71ee673e3e1343126a1a2c3639447f38fae6c761f50b2fd193ba0e68d7a
                                                                                    • Instruction Fuzzy Hash: 83412335900219DFCB00EFA4D894DEDBBBAFF49354F008069E955AB261DB30AD46CFA1
                                                                                    Function 006B9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetKeyboardState.USER32(?), ref: 006B9CA1
                                                                                    • GetAsyncKeyState.USER32(000000A0), ref: 006B9D22
                                                                                    • GetKeyState.USER32(000000A0), ref: 006B9D3D
                                                                                    • GetAsyncKeyState.USER32(000000A1), ref: 006B9D57
                                                                                    • GetKeyState.USER32(000000A1), ref: 006B9D6C
                                                                                    • GetAsyncKeyState.USER32(00000011), ref: 006B9D84
                                                                                    • GetKeyState.USER32(00000011), ref: 006B9D96
                                                                                    • GetAsyncKeyState.USER32(00000012), ref: 006B9DAE
                                                                                    • GetKeyState.USER32(00000012), ref: 006B9DC0
                                                                                    • GetAsyncKeyState.USER32(0000005B), ref: 006B9DD8
                                                                                    • GetKeyState.USER32(0000005B), ref: 006B9DEA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: State$Async$Keyboard
                                                                                    • String ID:
                                                                                    • API String ID: 541375521-0
                                                                                    • Opcode ID: e2bc0540c8a21c4936c2b12ee4ff0f4fd02c333a622c6e4e52782c4eaae3e536
                                                                                    • Instruction ID: 309bc8f29fece07833e18565f2f08a8e3c0b72021326ced35dba4b084f65b4e1
                                                                                    • Opcode Fuzzy Hash: e2bc0540c8a21c4936c2b12ee4ff0f4fd02c333a622c6e4e52782c4eaae3e536
                                                                                    • Instruction Fuzzy Hash: 6641FAB4504BC96DFF31876188453F5BEA36F11344F44805ADBC65A7C2EBA4A9C8CBB2
                                                                                    Function 006D055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WSAStartup.WSOCK32(00000101,?), ref: 006D05BC
                                                                                    • inet_addr.WSOCK32(?), ref: 006D061C
                                                                                    • gethostbyname.WSOCK32(?), ref: 006D0628
                                                                                    • IcmpCreateFile.IPHLPAPI ref: 006D0636
                                                                                    • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 006D06C6
                                                                                    • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 006D06E5
                                                                                    • IcmpCloseHandle.IPHLPAPI(?), ref: 006D07B9
                                                                                    • WSACleanup.WSOCK32 ref: 006D07BF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                                    • String ID: Ping
                                                                                    • API String ID: 1028309954-2246546115
                                                                                    • Opcode ID: f744e97e62bd25f43f31f365ed128d6cec604b05c97438288686e4b514a2cf73
                                                                                    • Instruction ID: e260601642c9f005a47192cedde05f3d1c2d62b7fd2d906a5690a071b1f2b4ae
                                                                                    • Opcode Fuzzy Hash: f744e97e62bd25f43f31f365ed128d6cec604b05c97438288686e4b514a2cf73
                                                                                    • Instruction Fuzzy Hash: 36917E359043419FE720DF15D888F5ABBE2AF44318F1485AAE8698F7A2C730ED45CF91
                                                                                    Function 006D8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$BuffCharLower
                                                                                    • String ID: cdecl$none$stdcall$winapi
                                                                                    • API String ID: 707087890-567219261
                                                                                    • Opcode ID: 1f75e2144166f9b95bfd9fba4c83cb9eade724b88069528e485ad232ba384028
                                                                                    • Instruction ID: d8606efebedf1b33916668a7f2392686f7f4266d9d6ef04ed0da87b7fa4af3f7
                                                                                    • Opcode Fuzzy Hash: 1f75e2144166f9b95bfd9fba4c83cb9eade724b88069528e485ad232ba384028
                                                                                    • Instruction Fuzzy Hash: C9518D31E001169FCB24DF68C9559FEB7B7AF64720B20422AE826A73C5EB34DD41CB90
                                                                                    Function 006D372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CoInitialize.OLE32 ref: 006D3774
                                                                                    • CoUninitialize.OLE32 ref: 006D377F
                                                                                    • CoCreateInstance.OLE32(?,00000000,00000017,006EFB78,?), ref: 006D37D9
                                                                                    • IIDFromString.OLE32(?,?), ref: 006D384C
                                                                                    • VariantInit.OLEAUT32(?), ref: 006D38E4
                                                                                    • VariantClear.OLEAUT32(?), ref: 006D3936
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                                                    • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                                    • API String ID: 636576611-1287834457
                                                                                    • Opcode ID: 9eef1503f4225c036104f3059bf53699c77e0b1e1d964a05d953f42c22793c27
                                                                                    • Instruction ID: ae19b54243b789900f48716b10a841b693b1a7b52fa0cc15bead912265d2af49
                                                                                    • Opcode Fuzzy Hash: 9eef1503f4225c036104f3059bf53699c77e0b1e1d964a05d953f42c22793c27
                                                                                    • Instruction Fuzzy Hash: 0D619EB1A08711AFD310DF54C888F9ABBE6AF49710F00080EF9859B391D770EE49DB96
                                                                                    Function 006C3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 006C33CF
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 006C33F0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: LoadString$_wcslen
                                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                                    • API String ID: 4099089115-3080491070
                                                                                    • Opcode ID: 4f3cc76f3034ac3b5fb0099a40131e686c91468ad0b50cffed4893c2cfde2175
                                                                                    • Instruction ID: 5ba4428beab7a939c1f6cbe09fc0fd7aaac2edb40a75487c00743d5c68a56894
                                                                                    • Opcode Fuzzy Hash: 4f3cc76f3034ac3b5fb0099a40131e686c91468ad0b50cffed4893c2cfde2175
                                                                                    • Instruction Fuzzy Hash: CA51D472900219AACF54EBE0CD42EFEB77AEF14741F508069F90572192EB352F99CB64
                                                                                    Function 006BB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$BuffCharUpper
                                                                                    • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                                                    • API String ID: 1256254125-769500911
                                                                                    • Opcode ID: 53ee9d9370d1f9c1dd63696a676115aa384a09b3b0e62dad7dc441d9952195a0
                                                                                    • Instruction ID: 02a38c614ae2497e552f6ed74c254dfad5b03a1f960853fe3238df1857b66fc9
                                                                                    • Opcode Fuzzy Hash: 53ee9d9370d1f9c1dd63696a676115aa384a09b3b0e62dad7dc441d9952195a0
                                                                                    • Instruction Fuzzy Hash: 2F41C4B2A001269BCB205F7D8C905FE77A7ABA1754B245229E425DB384FB75CDC2C790
                                                                                    Function 006C5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 006C53A0
                                                                                    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 006C5416
                                                                                    • GetLastError.KERNEL32 ref: 006C5420
                                                                                    • SetErrorMode.KERNEL32(00000000,READY), ref: 006C54A7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Error$Mode$DiskFreeLastSpace
                                                                                    • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                    • API String ID: 4194297153-14809454
                                                                                    • Opcode ID: 2884ace7b66325ac1660f64ed57277a2b3b6eca817c13c16520f0d9b8d2cd311
                                                                                    • Instruction ID: ed3cc6ff74742522545ca2a7adc7c8bac353d35be51aa4ddd428e02a7e58382b
                                                                                    • Opcode Fuzzy Hash: 2884ace7b66325ac1660f64ed57277a2b3b6eca817c13c16520f0d9b8d2cd311
                                                                                    • Instruction Fuzzy Hash: 3A314C75A006049FC714DF68C888FF97BE6EB45305F148069E806DB292DA75EDC6CB90
                                                                                    Function 006E3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateMenu.USER32 ref: 006E3C79
                                                                                    • SetMenu.USER32(?,00000000), ref: 006E3C88
                                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006E3D10
                                                                                    • IsMenu.USER32(?), ref: 006E3D24
                                                                                    • CreatePopupMenu.USER32 ref: 006E3D2E
                                                                                    • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006E3D5B
                                                                                    • DrawMenuBar.USER32 ref: 006E3D63
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                                    • String ID: 0$F
                                                                                    • API String ID: 161812096-3044882817
                                                                                    • Opcode ID: c56d5c6743a9104eea619158b3c6102150ef2e0f1d92a5723f3ce15b46f8cbbc
                                                                                    • Instruction ID: 45aa606a3a49f4f034d5ffec93494aa6b495503c62595addc567e6965759a6ad
                                                                                    • Opcode Fuzzy Hash: c56d5c6743a9104eea619158b3c6102150ef2e0f1d92a5723f3ce15b46f8cbbc
                                                                                    • Instruction Fuzzy Hash: 7C416D75A02359EFDB14CF65D888AEA77B6FF49350F144028F9469B3A0D730AA21CF94
                                                                                    Function 006B1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006B3CCA
                                                                                    • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 006B1F64
                                                                                    • GetDlgCtrlID.USER32 ref: 006B1F6F
                                                                                    • GetParent.USER32 ref: 006B1F8B
                                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 006B1F8E
                                                                                    • GetDlgCtrlID.USER32(?), ref: 006B1F97
                                                                                    • GetParent.USER32(?), ref: 006B1FAB
                                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 006B1FAE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                                    • String ID: ComboBox$ListBox
                                                                                    • API String ID: 711023334-1403004172
                                                                                    • Opcode ID: 5e0f7ffd6c95187fc44baadcdbaba74d0e3c444d8c8d91717e5912091d23a50c
                                                                                    • Instruction ID: c0b2930f86dc1a276eb191b4c8107c750d290ffb95dbcfa983d09e5d5c3626f0
                                                                                    • Opcode Fuzzy Hash: 5e0f7ffd6c95187fc44baadcdbaba74d0e3c444d8c8d91717e5912091d23a50c
                                                                                    • Instruction Fuzzy Hash: 6C21B0B4A00214BBCF04AFA0CC95DFEBBBAEF06310F500519B9616B291CB345949DB64
                                                                                    Function 006B1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006B3CCA
                                                                                    • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 006B2043
                                                                                    • GetDlgCtrlID.USER32 ref: 006B204E
                                                                                    • GetParent.USER32 ref: 006B206A
                                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 006B206D
                                                                                    • GetDlgCtrlID.USER32(?), ref: 006B2076
                                                                                    • GetParent.USER32(?), ref: 006B208A
                                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 006B208D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                                    • String ID: ComboBox$ListBox
                                                                                    • API String ID: 711023334-1403004172
                                                                                    • Opcode ID: 7108d847d1ed3d96e77bb09efbb2b37f8fdfb2d9f0cc928ef81415d187e290e7
                                                                                    • Instruction ID: 97e26c30c7e5967e62d14d6db4f9b8be35bbcaff96bf2f121516b054fd12a93e
                                                                                    • Opcode Fuzzy Hash: 7108d847d1ed3d96e77bb09efbb2b37f8fdfb2d9f0cc928ef81415d187e290e7
                                                                                    • Instruction Fuzzy Hash: DD21D4B5A00214BBCF14AFA4CC85EEEBBBAEF05310F100405B951A72A1CB794959DB60
                                                                                    Function 006E3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 006E3A9D
                                                                                    • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 006E3AA0
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E3AC7
                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006E3AEA
                                                                                    • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 006E3B62
                                                                                    • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 006E3BAC
                                                                                    • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 006E3BC7
                                                                                    • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 006E3BE2
                                                                                    • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 006E3BF6
                                                                                    • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 006E3C13
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$LongWindow
                                                                                    • String ID:
                                                                                    • API String ID: 312131281-0
                                                                                    • Opcode ID: 1a445411a3d86207bec8fe381e6ce3a58e92e72cdcc58480b290e2060c6e53da
                                                                                    • Instruction ID: 5d9d9cffa6f59b09425edb63059cb8815b469a7ae9b056bdfccd3771c6eedcc1
                                                                                    • Opcode Fuzzy Hash: 1a445411a3d86207bec8fe381e6ce3a58e92e72cdcc58480b290e2060c6e53da
                                                                                    • Instruction Fuzzy Hash: EE619B75900398AFDB20CFA8CC85EEE77B9EB09710F104099FA05A7391C774AA86DB50
                                                                                    Function 006BB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 006BB151
                                                                                    • GetForegroundWindow.USER32(00000000,?,?,?,?,?,006BA1E1,?,00000001), ref: 006BB165
                                                                                    • GetWindowThreadProcessId.USER32(00000000), ref: 006BB16C
                                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006BA1E1,?,00000001), ref: 006BB17B
                                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 006BB18D
                                                                                    • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,006BA1E1,?,00000001), ref: 006BB1A6
                                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006BA1E1,?,00000001), ref: 006BB1B8
                                                                                    • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,006BA1E1,?,00000001), ref: 006BB1FD
                                                                                    • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,006BA1E1,?,00000001), ref: 006BB212
                                                                                    • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,006BA1E1,?,00000001), ref: 006BB21D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                    • String ID:
                                                                                    • API String ID: 2156557900-0
                                                                                    • Opcode ID: 205470e9e4b1bd8133c5bdaec3c907e6eed98d01a2dcbc1dbca2d9f8b3809c56
                                                                                    • Instruction ID: 2872be8763bcae0db6b366e5096c230b6be4cff03a0c8c922d888e3305b85447
                                                                                    • Opcode Fuzzy Hash: 205470e9e4b1bd8133c5bdaec3c907e6eed98d01a2dcbc1dbca2d9f8b3809c56
                                                                                    • Instruction Fuzzy Hash: 46314FB5610204AFDB209F64DC84FFE7BABEB51321F14A015F915DA290D7B89E828F64
                                                                                    Function 00682C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 00682C94
                                                                                      • Part of subcall function 006829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000), ref: 006829DE
                                                                                      • Part of subcall function 006829C8: GetLastError.KERNEL32(00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000,00000000), ref: 006829F0
                                                                                    • _free.LIBCMT ref: 00682CA0
                                                                                    • _free.LIBCMT ref: 00682CAB
                                                                                    • _free.LIBCMT ref: 00682CB6
                                                                                    • _free.LIBCMT ref: 00682CC1
                                                                                    • _free.LIBCMT ref: 00682CCC
                                                                                    • _free.LIBCMT ref: 00682CD7
                                                                                    • _free.LIBCMT ref: 00682CE2
                                                                                    • _free.LIBCMT ref: 00682CED
                                                                                    • _free.LIBCMT ref: 00682CFB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: b9d3b683d0c2bf10045ab361d816f3e6f9a3357953f6ce3fb103d962275d0525
                                                                                    • Instruction ID: 37a2fa14f4dea81b8adac081404ee4bf63ba5a5b388ead78e8ce01dded16ed5b
                                                                                    • Opcode Fuzzy Hash: b9d3b683d0c2bf10045ab361d816f3e6f9a3357953f6ce3fb103d962275d0525
                                                                                    • Instruction Fuzzy Hash: 0D11D476100109AFCF82FF55D892CDD3BA6FF05750F4246A8FA489F222DA35EE509B94
                                                                                    Function 006C7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 006C7FAD
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006C7FC1
                                                                                    • GetFileAttributesW.KERNEL32(?), ref: 006C7FEB
                                                                                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 006C8005
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006C8017
                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006C8060
                                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 006C80B0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CurrentDirectory$AttributesFile
                                                                                    • String ID: *.*
                                                                                    • API String ID: 769691225-438819550
                                                                                    • Opcode ID: 110768b0ea1ada6693c56c1b6bcf26934b51abe4dcf689b00dafd8c86ccafe64
                                                                                    • Instruction ID: cacd6ce94ea2cee1134ad68319602686df4b2a700adb8b1b19e8d72eaf5d6ed3
                                                                                    • Opcode Fuzzy Hash: 110768b0ea1ada6693c56c1b6bcf26934b51abe4dcf689b00dafd8c86ccafe64
                                                                                    • Instruction Fuzzy Hash: 4A817B725082459FCB24EF14C884EBAB3EAFF89310F14485EF885D7251EB35ED498B92
                                                                                    Function 00655BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetWindowLongW.USER32(?,000000EB), ref: 00655C7A
                                                                                      • Part of subcall function 00655D0A: GetClientRect.USER32(?,?), ref: 00655D30
                                                                                      • Part of subcall function 00655D0A: GetWindowRect.USER32(?,?), ref: 00655D71
                                                                                      • Part of subcall function 00655D0A: ScreenToClient.USER32(?,?), ref: 00655D99
                                                                                    • GetDC.USER32 ref: 006946F5
                                                                                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00694708
                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 00694716
                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 0069472B
                                                                                    • ReleaseDC.USER32(?,00000000), ref: 00694733
                                                                                    • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 006947C4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                                    • String ID: U
                                                                                    • API String ID: 4009187628-3372436214
                                                                                    • Opcode ID: 03378a5fb818272797061f0067fa8cfe546ffaa08a6f2fe3e6a16be974529062
                                                                                    • Instruction ID: 61d287ad58591874cbfead99be587787e1861bddd0ecdf995e8c359c3eb77c15
                                                                                    • Opcode Fuzzy Hash: 03378a5fb818272797061f0067fa8cfe546ffaa08a6f2fe3e6a16be974529062
                                                                                    • Instruction Fuzzy Hash: 9B71AC31400209DFCF218FA4C984EFA7BBBFF4A365F144269ED565A666CB319882DF50
                                                                                    Function 006C359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006C35E4
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • LoadStringW.USER32(00722390,?,00000FFF,?), ref: 006C360A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: LoadString$_wcslen
                                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                    • API String ID: 4099089115-2391861430
                                                                                    • Opcode ID: d42671aa99c2551266909c801787b007e7a075bccc080bf4c656560477ba85f9
                                                                                    • Instruction ID: 9bcbb1266793ee0cd10c66c65f558c622ecf0679baa4adaab6d3fd359dc58ffc
                                                                                    • Opcode Fuzzy Hash: d42671aa99c2551266909c801787b007e7a075bccc080bf4c656560477ba85f9
                                                                                    • Instruction Fuzzy Hash: C951A371800259BACF54EBA0CC42EEDBB76EF14301F54412DF505722A2DB311B99CFA8
                                                                                    Function 006CC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006CC272
                                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006CC29A
                                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006CC2CA
                                                                                    • GetLastError.KERNEL32 ref: 006CC322
                                                                                    • SetEvent.KERNEL32(?), ref: 006CC336
                                                                                    • InternetCloseHandle.WININET(00000000), ref: 006CC341
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                                    • String ID:
                                                                                    • API String ID: 3113390036-3916222277
                                                                                    • Opcode ID: d21bfe09543be6b4cbafa19429e1a60e0161329f3bcf34153e7b5953018ee796
                                                                                    • Instruction ID: 0dd4e7102ea74cdbfbd8e39fea8cc5b678bc5543d48a38b8a6f2e1ddb6956f60
                                                                                    • Opcode Fuzzy Hash: d21bfe09543be6b4cbafa19429e1a60e0161329f3bcf34153e7b5953018ee796
                                                                                    • Instruction Fuzzy Hash: D1318DB1600344AFDB219F649888FBB7BFEEB49760B14851EF44E97201DB34DD468B61
                                                                                    Function 006B989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00693AAF,?,?,Bad directive syntax error,006ECC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 006B98BC
                                                                                    • LoadStringW.USER32(00000000,?,00693AAF,?), ref: 006B98C3
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 006B9987
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: HandleLoadMessageModuleString_wcslen
                                                                                    • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                    • API String ID: 858772685-4153970271
                                                                                    • Opcode ID: 5ac1e092f7084baee30c567e093a0edfa99d8c6a7827488a4ef90439556d54d8
                                                                                    • Instruction ID: 0ceea919c73959623d3e5bb39f7e6a56cdeaf2fcf3f0ecca097bb2535983ef5c
                                                                                    • Opcode Fuzzy Hash: 5ac1e092f7084baee30c567e093a0edfa99d8c6a7827488a4ef90439556d54d8
                                                                                    • Instruction Fuzzy Hash: 8421B17180025EEBCF55AF90CC06EEE7736FF18701F044429F915660A2EB319658CB24
                                                                                    Function 006B209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetParent.USER32 ref: 006B20AB
                                                                                    • GetClassNameW.USER32(00000000,?,00000100), ref: 006B20C0
                                                                                    • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 006B214D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClassMessageNameParentSend
                                                                                    • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                    • API String ID: 1290815626-3381328864
                                                                                    • Opcode ID: e6c07aef0dabb09e70c86b5d41777fdae6e743cd41793bafbd9f9e0a08050837
                                                                                    • Instruction ID: d6f98f37cf39b4f03f5a070cc538071893c34a1439f97d24b9bab33e27f68eba
                                                                                    • Opcode Fuzzy Hash: e6c07aef0dabb09e70c86b5d41777fdae6e743cd41793bafbd9f9e0a08050837
                                                                                    • Instruction Fuzzy Hash: BE1136F6688307B9F7156228DC1ACE733DECB05324B20401AFB08E40D1EE6968C25B18
                                                                                    Function 0068CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                                                    • String ID:
                                                                                    • API String ID: 1282221369-0
                                                                                    • Opcode ID: 06bed5bfb709cdb6cd1eaed75daad789a23703cdd575483f78d4fe227051f7f7
                                                                                    • Instruction ID: 1c76ea8e47d97b5e4dbf84f0e90ecc1a9f2f85c8c69c668c23fed771bd1c0118
                                                                                    • Opcode Fuzzy Hash: 06bed5bfb709cdb6cd1eaed75daad789a23703cdd575483f78d4fe227051f7f7
                                                                                    • Instruction Fuzzy Hash: 58610BB1A05301AFEF31BFB49855AA97BA7EF05320F14436EFA4497382D6359D0287B4
                                                                                    Function 006E50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 006E5186
                                                                                    • ShowWindow.USER32(?,00000000), ref: 006E51C7
                                                                                    • ShowWindow.USER32(?,00000005,?,00000000), ref: 006E51CD
                                                                                    • SetFocus.USER32(?,?,00000005,?,00000000), ref: 006E51D1
                                                                                      • Part of subcall function 006E6FBA: DeleteObject.GDI32(00000000), ref: 006E6FE6
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E520D
                                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 006E521A
                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 006E524D
                                                                                    • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 006E5287
                                                                                    • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 006E5296
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                                                    • String ID:
                                                                                    • API String ID: 3210457359-0
                                                                                    • Opcode ID: 289fd64a2e9ac5cb62ace5a1a87b55f62c8ad09730e8ab3434e1f64744260bd1
                                                                                    • Instruction ID: a1bde858da8eefc56f5182d47ad68202a95029b79f7d7a4876aa18943a931fbe
                                                                                    • Opcode Fuzzy Hash: 289fd64a2e9ac5cb62ace5a1a87b55f62c8ad09730e8ab3434e1f64744260bd1
                                                                                    • Instruction Fuzzy Hash: 3C51B530A52B88BFEF209F26CC45BD93B67FB05329F148015FA169A3E1C3759A81DB41
                                                                                    Function 00668B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 006A6890
                                                                                    • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 006A68A9
                                                                                    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 006A68B9
                                                                                    • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 006A68D1
                                                                                    • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 006A68F2
                                                                                    • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00668874,00000000,00000000,00000000,000000FF,00000000), ref: 006A6901
                                                                                    • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 006A691E
                                                                                    • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00668874,00000000,00000000,00000000,000000FF,00000000), ref: 006A692D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                                    • String ID:
                                                                                    • API String ID: 1268354404-0
                                                                                    • Opcode ID: 5b519791c292dd613191cc357dbea5a4bb7e088526e55660b891934aa07cb4d2
                                                                                    • Instruction ID: cbc6a2c90ae81fec8042f04b5a98bac95a6e6cfdbd2e34810b401705293ae5de
                                                                                    • Opcode Fuzzy Hash: 5b519791c292dd613191cc357dbea5a4bb7e088526e55660b891934aa07cb4d2
                                                                                    • Instruction Fuzzy Hash: A55168B0600309EFDB20DF24CC95FAA7BB6FB58760F144618F9569B2A0DB70AD91DB50
                                                                                    Function 006CC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006CC182
                                                                                    • GetLastError.KERNEL32 ref: 006CC195
                                                                                    • SetEvent.KERNEL32(?), ref: 006CC1A9
                                                                                      • Part of subcall function 006CC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006CC272
                                                                                      • Part of subcall function 006CC253: GetLastError.KERNEL32 ref: 006CC322
                                                                                      • Part of subcall function 006CC253: SetEvent.KERNEL32(?), ref: 006CC336
                                                                                      • Part of subcall function 006CC253: InternetCloseHandle.WININET(00000000), ref: 006CC341
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                                                    • String ID:
                                                                                    • API String ID: 337547030-0
                                                                                    • Opcode ID: f47cc3a761125de72a1a8be5b47582e81045b6d8477dea198198bd9cee3ab2ad
                                                                                    • Instruction ID: 2fb80f19d8eaa27dd2e1c91121020cf1cbeccc4470d50f934d445d71b3285b5a
                                                                                    • Opcode Fuzzy Hash: f47cc3a761125de72a1a8be5b47582e81045b6d8477dea198198bd9cee3ab2ad
                                                                                    • Instruction Fuzzy Hash: A1319A71600741AFDB219FA5DC48FB6BBEAFF18320B04441DF95A87610C734EA169BA0
                                                                                    Function 006B25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 006B3A57
                                                                                      • Part of subcall function 006B3A3D: GetCurrentThreadId.KERNEL32 ref: 006B3A5E
                                                                                      • Part of subcall function 006B3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006B25B3), ref: 006B3A65
                                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 006B25BD
                                                                                    • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 006B25DB
                                                                                    • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 006B25DF
                                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 006B25E9
                                                                                    • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 006B2601
                                                                                    • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 006B2605
                                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 006B260F
                                                                                    • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 006B2623
                                                                                    • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 006B2627
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                    • String ID:
                                                                                    • API String ID: 2014098862-0
                                                                                    • Opcode ID: 1d15e983f265e9dda18a8195b92ece93e223f900aba25986f5329c9bac1c2b92
                                                                                    • Instruction ID: 93006d28a02ce1007c137b9e5b0f2b9f09c72d0ac6173bfd370aa9098e74d0f6
                                                                                    • Opcode Fuzzy Hash: 1d15e983f265e9dda18a8195b92ece93e223f900aba25986f5329c9bac1c2b92
                                                                                    • Instruction Fuzzy Hash: DC01D871390360BBFB206769DCCAF9A3F5ADB4EB22F101015F314AE1D1C9E114859A69
                                                                                    Function 006B1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,006B1449,?,?,00000000), ref: 006B180C
                                                                                    • HeapAlloc.KERNEL32(00000000,?,006B1449,?,?,00000000), ref: 006B1813
                                                                                    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,006B1449,?,?,00000000), ref: 006B1828
                                                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,006B1449,?,?,00000000), ref: 006B1830
                                                                                    • DuplicateHandle.KERNEL32(00000000,?,006B1449,?,?,00000000), ref: 006B1833
                                                                                    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,006B1449,?,?,00000000), ref: 006B1843
                                                                                    • GetCurrentProcess.KERNEL32(006B1449,00000000,?,006B1449,?,?,00000000), ref: 006B184B
                                                                                    • DuplicateHandle.KERNEL32(00000000,?,006B1449,?,?,00000000), ref: 006B184E
                                                                                    • CreateThread.KERNEL32(00000000,00000000,006B1874,00000000,00000000,00000000), ref: 006B1868
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                    • String ID:
                                                                                    • API String ID: 1957940570-0
                                                                                    • Opcode ID: 918367fc0e8b81dc4c440407d3bdf2c39be7698a68f3f7f5fb5c3fcee0653402
                                                                                    • Instruction ID: bde031508723f2e651ea4d9183ef5c6a8f50ddc48f52728352c75e23d70ff0f8
                                                                                    • Opcode Fuzzy Hash: 918367fc0e8b81dc4c440407d3bdf2c39be7698a68f3f7f5fb5c3fcee0653402
                                                                                    • Instruction Fuzzy Hash: 5501BBB5250348BFE710ABA5DC8DFAB3BADEB89B11F415411FA05DF1A1CA709801CB20
                                                                                    Function 00683E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: __alldvrm$_strrchr
                                                                                    • String ID: }}g$}}g$}}g
                                                                                    • API String ID: 1036877536-865539186
                                                                                    • Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                                    • Instruction ID: 5a3950477ab579e57ae2cac708db438ba8943a5dbcc49d070fcf7343e7c1e4a1
                                                                                    • Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                                    • Instruction Fuzzy Hash: 03A13871E003979FDB25EF18C8917BEBBE6EF65350F14426DE6859B382CA348941C790
                                                                                    Function 006DA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006BD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 006BD501
                                                                                      • Part of subcall function 006BD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 006BD50F
                                                                                      • Part of subcall function 006BD4DC: FindCloseChangeNotification.KERNEL32(00000000), ref: 006BD5DC
                                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 006DA16D
                                                                                    • GetLastError.KERNEL32 ref: 006DA180
                                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 006DA1B3
                                                                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 006DA268
                                                                                    • GetLastError.KERNEL32(00000000), ref: 006DA273
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006DA2C4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
                                                                                    • String ID: SeDebugPrivilege
                                                                                    • API String ID: 1701285019-2896544425
                                                                                    • Opcode ID: 7bcca4ff8183fec0fb3d7f0f3bd117d281644eef0a3003df0b8816e4867f2b7c
                                                                                    • Instruction ID: 29a0ebd954fd8cbf2ae9519bd4de5e63cfac72441b0dbe4e89677804f4aaa82e
                                                                                    • Opcode Fuzzy Hash: 7bcca4ff8183fec0fb3d7f0f3bd117d281644eef0a3003df0b8816e4867f2b7c
                                                                                    • Instruction Fuzzy Hash: 0C61B1706082429FD710DF59C894F55BBE2AF44318F18849DE4664F7A3C772ED4ACB92
                                                                                    Function 006E3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 006E3925
                                                                                    • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 006E393A
                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 006E3954
                                                                                    • _wcslen.LIBCMT ref: 006E3999
                                                                                    • SendMessageW.USER32(?,00001057,00000000,?), ref: 006E39C6
                                                                                    • SendMessageW.USER32(?,00001061,?,0000000F), ref: 006E39F4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$Window_wcslen
                                                                                    • String ID: SysListView32
                                                                                    • API String ID: 2147712094-78025650
                                                                                    • Opcode ID: 5bb3831330d1b7cf88b17d602ff3bb5780db626d589c7b11c8a6b7d375ce0f20
                                                                                    • Instruction ID: 194cf10f26c2a2e922a10a91a842d5c52d59635a1ecfbbb3ee3e4e669fea9b25
                                                                                    • Opcode Fuzzy Hash: 5bb3831330d1b7cf88b17d602ff3bb5780db626d589c7b11c8a6b7d375ce0f20
                                                                                    • Instruction Fuzzy Hash: 8041C371A00369ABDF219F65CC49BEB77AAEF08350F10012AF948E7381D7759A85CB90
                                                                                    Function 006BBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006BBCFD
                                                                                    • IsMenu.USER32(00000000), ref: 006BBD1D
                                                                                    • CreatePopupMenu.USER32 ref: 006BBD53
                                                                                    • GetMenuItemCount.USER32(01905440), ref: 006BBDA4
                                                                                    • InsertMenuItemW.USER32(01905440,?,00000001,00000030), ref: 006BBDCC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                                    • String ID: 0$2
                                                                                    • API String ID: 93392585-3793063076
                                                                                    • Opcode ID: 25db1feac33698a062707ffe361532df14d21eaab4ed97beb6ab86a4bcd39193
                                                                                    • Instruction ID: 8de81548eb528e8948ec103541223f56bd5679690f84018777a59ae584caaab1
                                                                                    • Opcode Fuzzy Hash: 25db1feac33698a062707ffe361532df14d21eaab4ed97beb6ab86a4bcd39193
                                                                                    • Instruction Fuzzy Hash: B651ADB0A00305DBDF20CFA8D8C4BEEBBF6AF45324F146219E4119B391D7B89981CB61
                                                                                    Function 00672D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _ValidateLocalCookies.LIBCMT ref: 00672D4B
                                                                                    • ___except_validate_context_record.LIBVCRUNTIME ref: 00672D53
                                                                                    • _ValidateLocalCookies.LIBCMT ref: 00672DE1
                                                                                    • __IsNonwritableInCurrentImage.LIBCMT ref: 00672E0C
                                                                                    • _ValidateLocalCookies.LIBCMT ref: 00672E61
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                    • String ID: &Hg$csm
                                                                                    • API String ID: 1170836740-2821860413
                                                                                    • Opcode ID: 908a3242a8003fd113829ff961cb96749af7c19af0b55e5a83ebe46263baf016
                                                                                    • Instruction ID: cb1a0a967e69de52409cace6cd1779085ca1fd51ddd6d7b4315ca054ee5abbb3
                                                                                    • Opcode Fuzzy Hash: 908a3242a8003fd113829ff961cb96749af7c19af0b55e5a83ebe46263baf016
                                                                                    • Instruction Fuzzy Hash: 5A417334E0021A9BCF20DF68CC65ADEBBB7BF45324F14C159E9186B392D731AA45CB91
                                                                                    Function 006BC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadIconW.USER32(00000000,00007F03), ref: 006BC913
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: IconLoad
                                                                                    • String ID: blank$info$question$stop$warning
                                                                                    • API String ID: 2457776203-404129466
                                                                                    • Opcode ID: 63792f85694c97050c8ae8c4f2bbfda7245ecda98e1bfa8879e4d05990468be6
                                                                                    • Instruction ID: 8fb7ff1646eae8abdd9635a346fe73b730789d9af23bd082bf8e68907c930f8a
                                                                                    • Opcode Fuzzy Hash: 63792f85694c97050c8ae8c4f2bbfda7245ecda98e1bfa8879e4d05990468be6
                                                                                    • Instruction Fuzzy Hash: 2A113DB1689307BAF700AB189C83CEA279DDF15734B10402EF504E62C2EB745FC15368
                                                                                    Function 006BDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                                    • String ID: 0.0.0.0
                                                                                    • API String ID: 642191829-3771769585
                                                                                    • Opcode ID: a0a67cbd8caa406e344e1ef55f87ba3d892e49bd9793bddf8e937bfeea14c34a
                                                                                    • Instruction ID: afa3252aac61b04529258ecc6984211121179c4deab62bbcfcb478efa44d6625
                                                                                    • Opcode Fuzzy Hash: a0a67cbd8caa406e344e1ef55f87ba3d892e49bd9793bddf8e937bfeea14c34a
                                                                                    • Instruction Fuzzy Hash: 0511E4B1904204AFDB60AB24DC4AEEE77AEDF11720F000169F509AE191FF75CAC28B60
                                                                                    Function 006E9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00669BB2
                                                                                    • GetSystemMetrics.USER32(0000000F), ref: 006E9FC7
                                                                                    • GetSystemMetrics.USER32(0000000F), ref: 006E9FE7
                                                                                    • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 006EA224
                                                                                    • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 006EA242
                                                                                    • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 006EA263
                                                                                    • ShowWindow.USER32(00000003,00000000), ref: 006EA282
                                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 006EA2A7
                                                                                    • DefDlgProcW.USER32(?,00000005,?,?), ref: 006EA2CA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                                    • String ID:
                                                                                    • API String ID: 1211466189-0
                                                                                    • Opcode ID: a92ab1afdba297c95d04d81ea7d0b05914da579f91c5ffcebad46739246309c3
                                                                                    • Instruction ID: 6dc3310bb300e04edf323c3737fa26d66f83f5f14ea422e601df4e3955ab053d
                                                                                    • Opcode Fuzzy Hash: a92ab1afdba297c95d04d81ea7d0b05914da579f91c5ffcebad46739246309c3
                                                                                    • Instruction Fuzzy Hash: 3DB1B8316013559FCF14CFAAC9857EA7BB2BF44711F088069ED89AB299D731AA40CB61
                                                                                    Function 006BED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$LocalTime
                                                                                    • String ID:
                                                                                    • API String ID: 952045576-0
                                                                                    • Opcode ID: 43c1b3dcb361765d0c8efa7961eff423f259852148aca93a6a327ccbfbcb34e7
                                                                                    • Instruction ID: 4d1600347db963bf36b0f828343048172ee3e2e91e811dac15066aea761f47ea
                                                                                    • Opcode Fuzzy Hash: 43c1b3dcb361765d0c8efa7961eff423f259852148aca93a6a327ccbfbcb34e7
                                                                                    • Instruction Fuzzy Hash: 7E41A465D1011876CB51EBB4C88A9CFB7BAAF45310F50856AF628E3122FB34D345C3EA
                                                                                    Function 0066F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,006A682C,00000004,00000000,00000000), ref: 0066F953
                                                                                    • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,006A682C,00000004,00000000,00000000), ref: 006AF3D1
                                                                                    • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,006A682C,00000004,00000000,00000000), ref: 006AF454
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ShowWindow
                                                                                    • String ID:
                                                                                    • API String ID: 1268545403-0
                                                                                    • Opcode ID: e8569e0496506cad1a7a6bb13c3ad5a7944420ed1a83a20f1c2bd547613f73a0
                                                                                    • Instruction ID: 3e8dd00041744869577e9db6bd00ec1d0578ad7698bdb9e713c5c4d44ec6c495
                                                                                    • Opcode Fuzzy Hash: e8569e0496506cad1a7a6bb13c3ad5a7944420ed1a83a20f1c2bd547613f73a0
                                                                                    • Instruction Fuzzy Hash: 9F412C30108780BEDB389B69E8C87AA7BE3AB56324F14563CF09757761C631A882CB51
                                                                                    Function 006E2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DeleteObject.GDI32(00000000), ref: 006E2D1B
                                                                                    • GetDC.USER32(00000000), ref: 006E2D23
                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 006E2D2E
                                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 006E2D3A
                                                                                    • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 006E2D76
                                                                                    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 006E2D87
                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,006E5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 006E2DC2
                                                                                    • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 006E2DE1
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                    • String ID:
                                                                                    • API String ID: 3864802216-0
                                                                                    • Opcode ID: 9400c7ddb19203b077b6315f845e8507bb71fef352128401393a13044b58a791
                                                                                    • Instruction ID: 2c46d3fe46776d88a03d11d9c059c08a8fc909d24e7f9ada5ecd877faea600e8
                                                                                    • Opcode Fuzzy Hash: 9400c7ddb19203b077b6315f845e8507bb71fef352128401393a13044b58a791
                                                                                    • Instruction Fuzzy Hash: 44318B72202394BBEB118F558C8AFEB3BAEEF49721F044055FE089E291C6759C41CBA4
                                                                                    Function 006B5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _memcmp
                                                                                    • String ID:
                                                                                    • API String ID: 2931989736-0
                                                                                    • Opcode ID: 2164783fb890100c38a77aac52920042b6d58a595885bf24ad37c089f35efecb
                                                                                    • Instruction ID: 8d4bb7d90ad7ee06824dc04f96edd3c8530531143d5ec095bc7fd31ccea6d95c
                                                                                    • Opcode Fuzzy Hash: 2164783fb890100c38a77aac52920042b6d58a595885bf24ad37c089f35efecb
                                                                                    • Instruction Fuzzy Hash: A62125B1741A0877A20456258DA2FFB334FAF21798B644035FD0A9A681FB20EE5183A8
                                                                                    Function 006D4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: NULL Pointer assignment$Not an Object type
                                                                                    • API String ID: 0-572801152
                                                                                    • Opcode ID: ce70c0133d0eb88d411d725245e7adfad2ddba788626d114a708456fe6596459
                                                                                    • Instruction ID: 659377ed57de7fd775cfaebd97657a98a6af46bc809123657ef956f544738891
                                                                                    • Opcode Fuzzy Hash: ce70c0133d0eb88d411d725245e7adfad2ddba788626d114a708456fe6596459
                                                                                    • Instruction Fuzzy Hash: 8BD19F71E0060A9FDB10CF98C881BEEB7B6BF48354F15806AE916AB780E771DD45CB90
                                                                                    Function 00691522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCPInfo.KERNEL32(?,?), ref: 006915CE
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00691651
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006916E4
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 006916FB
                                                                                      • Part of subcall function 00683820: RtlAllocateHeap.NTDLL(00000000,?,00721444,?,0066FDF5,?,?,0065A976,00000010,00721440,006513FC,?,006513C6,?,00651129), ref: 00683852
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00691777
                                                                                    • __freea.LIBCMT ref: 006917A2
                                                                                    • __freea.LIBCMT ref: 006917AE
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                                                    • String ID:
                                                                                    • API String ID: 2829977744-0
                                                                                    • Opcode ID: a0bfd18f4efea1fc16634f866d79c21c76e0eb6323137dbadafff782514d6efa
                                                                                    • Instruction ID: 55be38dd855cef0775269546c04611ee2f37f723e0941782348fdee284835545
                                                                                    • Opcode Fuzzy Hash: a0bfd18f4efea1fc16634f866d79c21c76e0eb6323137dbadafff782514d6efa
                                                                                    • Instruction Fuzzy Hash: 6391B5B2E002179ADF218EB4C891AEE7BBF9F4A710F294659E901EF681D735DC41C760
                                                                                    Function 006D4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Variant$ClearInit
                                                                                    • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                    • API String ID: 2610073882-625585964
                                                                                    • Opcode ID: 4f29efa053ea4b7973d1c2b5a2ca52fce720d70adca4cef2c7bf61218927b6cd
                                                                                    • Instruction ID: 6f6cdec46b3a5b84f6fc0e6dd630e6fab4c93299b964de94a90b9650c59ebc6e
                                                                                    • Opcode Fuzzy Hash: 4f29efa053ea4b7973d1c2b5a2ca52fce720d70adca4cef2c7bf61218927b6cd
                                                                                    • Instruction Fuzzy Hash: E1916E71E00219ABDF24CFA5D884FEE7BBAAF45714F10855AE515AB380DB709D41CBA0
                                                                                    Function 006C1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 006C125C
                                                                                    • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 006C1284
                                                                                    • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 006C12A8
                                                                                    • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006C12D8
                                                                                    • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006C135F
                                                                                    • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006C13C4
                                                                                    • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006C1430
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                                                    • String ID:
                                                                                    • API String ID: 2550207440-0
                                                                                    • Opcode ID: f4533370e705293ad2696edbacf5285bb4fdd792f6322d9ddb6e55276ad162e5
                                                                                    • Instruction ID: dcbff5b9957a56928d13afb1b3f62d4a4f54f48eb863dd3a686b5b888dbf55fb
                                                                                    • Opcode Fuzzy Hash: f4533370e705293ad2696edbacf5285bb4fdd792f6322d9ddb6e55276ad162e5
                                                                                    • Instruction Fuzzy Hash: FF91C1759002199FEB04DF94C884FBEB7B6FF46325F14802DE950EB292D778A942CB94
                                                                                    Function 0066948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ObjectSelect$BeginCreatePath
                                                                                    • String ID:
                                                                                    • API String ID: 3225163088-0
                                                                                    • Opcode ID: 41ace14fa54e4566f7b8579da963997bb8174f939dbfb86d6444d50bbcbc4b8f
                                                                                    • Instruction ID: ebaab02ff6490bf0f448cd8a67ded644121bc86145bd582bf477ff43f783b99a
                                                                                    • Opcode Fuzzy Hash: 41ace14fa54e4566f7b8579da963997bb8174f939dbfb86d6444d50bbcbc4b8f
                                                                                    • Instruction Fuzzy Hash: 7B910671900219EFCB10CFA9CC84AEEBBBAFF49320F144559E916B7251D775AA42CF60
                                                                                    Function 006D3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VariantInit.OLEAUT32(?), ref: 006D396B
                                                                                    • CharUpperBuffW.USER32(?,?), ref: 006D3A7A
                                                                                    • _wcslen.LIBCMT ref: 006D3A8A
                                                                                    • VariantClear.OLEAUT32(?), ref: 006D3C1F
                                                                                      • Part of subcall function 006C0CDF: VariantInit.OLEAUT32(00000000), ref: 006C0D1F
                                                                                      • Part of subcall function 006C0CDF: VariantCopy.OLEAUT32(?,?), ref: 006C0D28
                                                                                      • Part of subcall function 006C0CDF: VariantClear.OLEAUT32(?), ref: 006C0D34
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                                                    • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                                    • API String ID: 4137639002-1221869570
                                                                                    • Opcode ID: c4c0ec6de551da3abee769222c260589d0cf5678eee1ad89ce948ae1b93ca86b
                                                                                    • Instruction ID: 39270efa2e954e5cd9546268d9ee7cecfec341b10250f495e10f437acee7721f
                                                                                    • Opcode Fuzzy Hash: c4c0ec6de551da3abee769222c260589d0cf5678eee1ad89ce948ae1b93ca86b
                                                                                    • Instruction Fuzzy Hash: FE917B74A083119FC744DF28C48196AB7E6FF89314F14882EF8899B351DB31EE46CB96
                                                                                    Function 006D4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?,?,?,006B035E), ref: 006B002B
                                                                                      • Part of subcall function 006B000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?,?), ref: 006B0046
                                                                                      • Part of subcall function 006B000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?,?), ref: 006B0054
                                                                                      • Part of subcall function 006B000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?), ref: 006B0064
                                                                                    • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 006D4C51
                                                                                    • _wcslen.LIBCMT ref: 006D4D59
                                                                                    • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 006D4DCF
                                                                                    • CoTaskMemFree.OLE32(?), ref: 006D4DDA
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                                                    • String ID: NULL Pointer assignment
                                                                                    • API String ID: 614568839-2785691316
                                                                                    • Opcode ID: 8ba821566733ba797796388fed9984a9e8dcb0f7437667ff56869adf01f47ce5
                                                                                    • Instruction ID: cabba6c6569fceadafb5883f3983f1e7464c37050f65846cf7b800a6e7c133c4
                                                                                    • Opcode Fuzzy Hash: 8ba821566733ba797796388fed9984a9e8dcb0f7437667ff56869adf01f47ce5
                                                                                    • Instruction Fuzzy Hash: EF91E871D00219EFDF14DFA4C891AEEB7BABF08310F10456AE915AB251EB309E45CFA0
                                                                                    Function 006E20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetMenu.USER32(?), ref: 006E2183
                                                                                    • GetMenuItemCount.USER32(00000000), ref: 006E21B5
                                                                                    • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 006E21DD
                                                                                    • _wcslen.LIBCMT ref: 006E2213
                                                                                    • GetMenuItemID.USER32(?,?), ref: 006E224D
                                                                                    • GetSubMenu.USER32(?,?), ref: 006E225B
                                                                                      • Part of subcall function 006B3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 006B3A57
                                                                                      • Part of subcall function 006B3A3D: GetCurrentThreadId.KERNEL32 ref: 006B3A5E
                                                                                      • Part of subcall function 006B3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006B25B3), ref: 006B3A65
                                                                                    • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 006E22E3
                                                                                      • Part of subcall function 006BE97B: Sleep.KERNEL32 ref: 006BE9F3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                                                    • String ID:
                                                                                    • API String ID: 4196846111-0
                                                                                    • Opcode ID: 6a3b107720cae6838966a3e6d136021e3ef0971d3813c4e0882c9387207c5170
                                                                                    • Instruction ID: 6b4c491fee5c9a8f68b2cef9f7a07fbf66ba77ecfe052b8d55b549d4c3fb6428
                                                                                    • Opcode Fuzzy Hash: 6a3b107720cae6838966a3e6d136021e3ef0971d3813c4e0882c9387207c5170
                                                                                    • Instruction Fuzzy Hash: F4717075A00346AFCB50DF65C895AAEB7F7AF48320F148459E916AB341D734EE428B90
                                                                                    Function 006E7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsWindow.USER32(01905530), ref: 006E7F37
                                                                                    • IsWindowEnabled.USER32(01905530), ref: 006E7F43
                                                                                    • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 006E801E
                                                                                    • SendMessageW.USER32(01905530,000000B0,?,?), ref: 006E8051
                                                                                    • IsDlgButtonChecked.USER32(?,?), ref: 006E8089
                                                                                    • GetWindowLongW.USER32(01905530,000000EC), ref: 006E80AB
                                                                                    • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 006E80C3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                                    • String ID:
                                                                                    • API String ID: 4072528602-0
                                                                                    • Opcode ID: 56591ca892e9b357a1b3acbea59d96481eb2f54562e7ef51da719fe834ac98b1
                                                                                    • Instruction ID: e3186c1ee642c1277a094ec20551ab9e8ccea41156a098053f848f455bd28838
                                                                                    • Opcode Fuzzy Hash: 56591ca892e9b357a1b3acbea59d96481eb2f54562e7ef51da719fe834ac98b1
                                                                                    • Instruction Fuzzy Hash: 8D719D3460A384AFEF259F66C894FEABBBBEF09300F144459E945973A1CB31A845CB10
                                                                                    Function 006BAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetParent.USER32(?), ref: 006BAEF9
                                                                                    • GetKeyboardState.USER32(?), ref: 006BAF0E
                                                                                    • SetKeyboardState.USER32(?), ref: 006BAF6F
                                                                                    • PostMessageW.USER32(?,00000101,00000010,?), ref: 006BAF9D
                                                                                    • PostMessageW.USER32(?,00000101,00000011,?), ref: 006BAFBC
                                                                                    • PostMessageW.USER32(?,00000101,00000012,?), ref: 006BAFFD
                                                                                    • PostMessageW.USER32(?,00000101,0000005B,?), ref: 006BB020
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessagePost$KeyboardState$Parent
                                                                                    • String ID:
                                                                                    • API String ID: 87235514-0
                                                                                    • Opcode ID: 90abc4f2fc79a6f83040b76cb75585dde4c321a1a5fea367b617d8303bd8be93
                                                                                    • Instruction ID: 1ca5be89aef2f0b5cc452de7dccf67c8296813edb368e9daa4574242ee728f70
                                                                                    • Opcode Fuzzy Hash: 90abc4f2fc79a6f83040b76cb75585dde4c321a1a5fea367b617d8303bd8be93
                                                                                    • Instruction Fuzzy Hash: 6E51DFE0A147D53DFB3692748845BFABEAA5B06304F088489E1E9459C2C3E8E8C8D751
                                                                                    Function 006BACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetParent.USER32(00000000), ref: 006BAD19
                                                                                    • GetKeyboardState.USER32(?), ref: 006BAD2E
                                                                                    • SetKeyboardState.USER32(?), ref: 006BAD8F
                                                                                    • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 006BADBB
                                                                                    • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 006BADD8
                                                                                    • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 006BAE17
                                                                                    • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 006BAE38
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessagePost$KeyboardState$Parent
                                                                                    • String ID:
                                                                                    • API String ID: 87235514-0
                                                                                    • Opcode ID: 6fd977928f4372f8d425fb5cb825e8d53dbcbad425b021d05a1a21294deafdbc
                                                                                    • Instruction ID: 443c0f9f64019a51ced76128afee6ee15403a94d2a1e76d9b6a05654c7be9e88
                                                                                    • Opcode Fuzzy Hash: 6fd977928f4372f8d425fb5cb825e8d53dbcbad425b021d05a1a21294deafdbc
                                                                                    • Instruction Fuzzy Hash: ED51C2F15047D53DFB3283A48C95BFA7EAA5F46300F088588E1D546982D2A4ECC9E762
                                                                                    Function 0068542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetConsoleCP.KERNEL32(00693CD6,?,?,?,?,?,?,?,?,00685BA3,?,?,00693CD6,?,?), ref: 00685470
                                                                                    • __fassign.LIBCMT ref: 006854EB
                                                                                    • __fassign.LIBCMT ref: 00685506
                                                                                    • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00693CD6,00000005,00000000,00000000), ref: 0068552C
                                                                                    • WriteFile.KERNEL32(?,00693CD6,00000000,00685BA3,00000000,?,?,?,?,?,?,?,?,?,00685BA3,?), ref: 0068554B
                                                                                    • WriteFile.KERNEL32(?,?,00000001,00685BA3,00000000,?,?,?,?,?,?,?,?,?,00685BA3,?), ref: 00685584
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                    • String ID:
                                                                                    • API String ID: 1324828854-0
                                                                                    • Opcode ID: 8bc444688a5becfeaa82be1cd5871c4de5d8912e3def656886b3077a745c46d8
                                                                                    • Instruction ID: 9c2f91ff78eb51590bfa49cd706e27a6fb07b26c7a2723f5cb4771b26b3f5c41
                                                                                    • Opcode Fuzzy Hash: 8bc444688a5becfeaa82be1cd5871c4de5d8912e3def656886b3077a745c46d8
                                                                                    • Instruction Fuzzy Hash: 9151D5709006499FDB10DFA8D885AEEBBFAEF08300F14425AF956E7391E7309A41CB61
                                                                                    Function 006D10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006D304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 006D307A
                                                                                      • Part of subcall function 006D304E: _wcslen.LIBCMT ref: 006D309B
                                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 006D1112
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D1121
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D11C9
                                                                                    • closesocket.WSOCK32(00000000), ref: 006D11F9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                                                    • String ID:
                                                                                    • API String ID: 2675159561-0
                                                                                    • Opcode ID: 70fa0b45bef8ad715b9a4a1d812dda38ec959c681052b0c539608d2faf55a933
                                                                                    • Instruction ID: 800166aca692fa9c44aa27e6b8066587a7ea5445de8b49068a19988257abfc1f
                                                                                    • Opcode Fuzzy Hash: 70fa0b45bef8ad715b9a4a1d812dda38ec959c681052b0c539608d2faf55a933
                                                                                    • Instruction Fuzzy Hash: 6341A231A00214AFDB109F54CC85BAABBABEF46364F14805AFD159F391D7B0AD46CBA1
                                                                                    Function 006BCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006BDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006BCF22,?), ref: 006BDDFD
                                                                                      • Part of subcall function 006BDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006BCF22,?), ref: 006BDE16
                                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 006BCF45
                                                                                    • MoveFileW.KERNEL32(?,?), ref: 006BCF7F
                                                                                    • _wcslen.LIBCMT ref: 006BD005
                                                                                    • _wcslen.LIBCMT ref: 006BD01B
                                                                                    • SHFileOperationW.SHELL32(?), ref: 006BD061
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                                                    • String ID: \*.*
                                                                                    • API String ID: 3164238972-1173974218
                                                                                    • Opcode ID: 6e24e7b29558f8c3ea1ec43bcc2c05024b7aa27c718654345af3322bcc96465a
                                                                                    • Instruction ID: 187796a909c7c8f4e806df4d2a061770edc9dd52b45eac536ca00fbc4c47eacd
                                                                                    • Opcode Fuzzy Hash: 6e24e7b29558f8c3ea1ec43bcc2c05024b7aa27c718654345af3322bcc96465a
                                                                                    • Instruction Fuzzy Hash: AF4158B19052189FDF52EFA4C981AEDB7BEAF44340F1000EAE505EB142EB34A7C5CB54
                                                                                    Function 006E2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 006E2E1C
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E2E4F
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E2E84
                                                                                    • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 006E2EB6
                                                                                    • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 006E2EE0
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E2EF1
                                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 006E2F0B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: LongWindow$MessageSend
                                                                                    • String ID:
                                                                                    • API String ID: 2178440468-0
                                                                                    • Opcode ID: 8d776af124fe6a3a02a38e86b8d3b526aa61499bb44b0147da4b2b33a12c447a
                                                                                    • Instruction ID: 4d833843c9946297defe7db25a7d5c4eea20aaba11b8ecda50b974d821287aa6
                                                                                    • Opcode Fuzzy Hash: 8d776af124fe6a3a02a38e86b8d3b526aa61499bb44b0147da4b2b33a12c447a
                                                                                    • Instruction Fuzzy Hash: 653116306462A29FDB208F19DCD4FA537EBFB5A720F1541A4F9408F2B1CB71AC819B41
                                                                                    Function 006B7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006B7769
                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006B778F
                                                                                    • SysAllocString.OLEAUT32(00000000), ref: 006B7792
                                                                                    • SysAllocString.OLEAUT32(?), ref: 006B77B0
                                                                                    • SysFreeString.OLEAUT32(?), ref: 006B77B9
                                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 006B77DE
                                                                                    • SysAllocString.OLEAUT32(?), ref: 006B77EC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                    • String ID:
                                                                                    • API String ID: 3761583154-0
                                                                                    • Opcode ID: dcd6ee4496b4e6c9eb7ce4ae58afa0c609c49672b402d8f2d50bc97dafdb2a05
                                                                                    • Instruction ID: 0c7c1c962b1021594a7346fea7bf090e100ba7fa3734315d2a55efd1e1c60704
                                                                                    • Opcode Fuzzy Hash: dcd6ee4496b4e6c9eb7ce4ae58afa0c609c49672b402d8f2d50bc97dafdb2a05
                                                                                    • Instruction Fuzzy Hash: E021A1B6604219AFDB10DFA8DC88CFB77EEEB493647108035F914DB290DA70DC828764
                                                                                    Function 006B77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006B7842
                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006B7868
                                                                                    • SysAllocString.OLEAUT32(00000000), ref: 006B786B
                                                                                    • SysAllocString.OLEAUT32 ref: 006B788C
                                                                                    • SysFreeString.OLEAUT32 ref: 006B7895
                                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 006B78AF
                                                                                    • SysAllocString.OLEAUT32(?), ref: 006B78BD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                    • String ID:
                                                                                    • API String ID: 3761583154-0
                                                                                    • Opcode ID: cfb936914df992e437df68701b18157b76bbb0d0fa47e5c1ef35b3f2d00ccb0a
                                                                                    • Instruction ID: 7c418fc60dc09dcc3180c6bc7db6f30140310cd34fc4821eccc020972d3c22c4
                                                                                    • Opcode Fuzzy Hash: cfb936914df992e437df68701b18157b76bbb0d0fa47e5c1ef35b3f2d00ccb0a
                                                                                    • Instruction Fuzzy Hash: 51214175608214BFDB109FB8DC88DEA77EEEB497607108135F915CB2A1DA74DC82CB64
                                                                                    Function 006C04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 006C04F2
                                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006C052E
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateHandlePipe
                                                                                    • String ID: nul
                                                                                    • API String ID: 1424370930-2873401336
                                                                                    • Opcode ID: cbb117dff21b3367e504117cea18a8d3e04ac598e7c829e7b6326b9637db9af4
                                                                                    • Instruction ID: e4e3185743f800393a234a48bb522d900bf6dac4582afeee67a65237cb315b99
                                                                                    • Opcode Fuzzy Hash: cbb117dff21b3367e504117cea18a8d3e04ac598e7c829e7b6326b9637db9af4
                                                                                    • Instruction Fuzzy Hash: 7D212CB5500305EFEF209F69D944FAA7BA6EF44724F604A1DE9A1D62E0D7709942CF20
                                                                                    Function 006C05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 006C05C6
                                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006C0601
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateHandlePipe
                                                                                    • String ID: nul
                                                                                    • API String ID: 1424370930-2873401336
                                                                                    • Opcode ID: df08f26ae4c6163bacf2490c9159e39b939d1eb40e14cb4ff58ca9ebdc1ec681
                                                                                    • Instruction ID: 9717bcfcb2204e52c4b27bc356df4e69e1f8528db8c14bd8d3796045edbd8df4
                                                                                    • Opcode Fuzzy Hash: df08f26ae4c6163bacf2490c9159e39b939d1eb40e14cb4ff58ca9ebdc1ec681
                                                                                    • Instruction Fuzzy Hash: 0F217F75500315DFEB209F6A8C44FAA77AAEF95B30F200A1DE9A1E72E0D7709961CB10
                                                                                    Function 006E40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0065600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0065604C
                                                                                      • Part of subcall function 0065600E: GetStockObject.GDI32(00000011), ref: 00656060
                                                                                      • Part of subcall function 0065600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0065606A
                                                                                    • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 006E4112
                                                                                    • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 006E411F
                                                                                    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 006E412A
                                                                                    • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 006E4139
                                                                                    • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 006E4145
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$CreateObjectStockWindow
                                                                                    • String ID: Msctls_Progress32
                                                                                    • API String ID: 1025951953-3636473452
                                                                                    • Opcode ID: e2faa7fa2db882f175603296336ab94e96fd4c75586fbbd01ae34145c1d35d24
                                                                                    • Instruction ID: a80b44ee265851ce110dad74b78f8858ccd749c1fd1ec81c27e751ad7691b078
                                                                                    • Opcode Fuzzy Hash: e2faa7fa2db882f175603296336ab94e96fd4c75586fbbd01ae34145c1d35d24
                                                                                    • Instruction Fuzzy Hash: 6611B6B11402197EEF118F65CC85EE77F5DEF097A8F014110BA18A6190CA769C61DBA4
                                                                                    Function 0068D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0068D7A3: _free.LIBCMT ref: 0068D7CC
                                                                                    • _free.LIBCMT ref: 0068D82D
                                                                                      • Part of subcall function 006829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000), ref: 006829DE
                                                                                      • Part of subcall function 006829C8: GetLastError.KERNEL32(00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000,00000000), ref: 006829F0
                                                                                    • _free.LIBCMT ref: 0068D838
                                                                                    • _free.LIBCMT ref: 0068D843
                                                                                    • _free.LIBCMT ref: 0068D897
                                                                                    • _free.LIBCMT ref: 0068D8A2
                                                                                    • _free.LIBCMT ref: 0068D8AD
                                                                                    • _free.LIBCMT ref: 0068D8B8
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                                    • Instruction ID: c61f7253699acb774a04e11736e0118f84b6c4b60a3d0bd989ea8072a2530fa9
                                                                                    • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                                    • Instruction Fuzzy Hash: 82113A71540B04AADAA1BFB1CC47FCB7BDEAF00B00F400A2DF299A60D2DA69F5058764
                                                                                    Function 006BDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 006BDA74
                                                                                    • LoadStringW.USER32(00000000), ref: 006BDA7B
                                                                                    • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 006BDA91
                                                                                    • LoadStringW.USER32(00000000), ref: 006BDA98
                                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 006BDADC
                                                                                    Strings
                                                                                    • %s (%d) : ==> %s: %s %s, xrefs: 006BDAB9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: HandleLoadModuleString$Message
                                                                                    • String ID: %s (%d) : ==> %s: %s %s
                                                                                    • API String ID: 4072794657-3128320259
                                                                                    • Opcode ID: b86389abb6545391aaa56f76fb62b9a6394fda1464e41c4a47f100654a3a2d19
                                                                                    • Instruction ID: cc6d827fb47d43f3934b028814b03e421275359aaa40df2fe8199816ac74727a
                                                                                    • Opcode Fuzzy Hash: b86389abb6545391aaa56f76fb62b9a6394fda1464e41c4a47f100654a3a2d19
                                                                                    • Instruction Fuzzy Hash: 2D01A2F2500348BFEB009BA4DDC9EE7336DEB08711F000491B706E6041E6749E858F34
                                                                                    Function 006C096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InterlockedExchange.KERNEL32(018FE1A0,018FE1A0), ref: 006C097B
                                                                                    • EnterCriticalSection.KERNEL32(018FE180,00000000), ref: 006C098D
                                                                                    • TerminateThread.KERNEL32(?,000001F6), ref: 006C099B
                                                                                    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 006C09A9
                                                                                    • CloseHandle.KERNEL32(?), ref: 006C09B8
                                                                                    • InterlockedExchange.KERNEL32(018FE1A0,000001F6), ref: 006C09C8
                                                                                    • LeaveCriticalSection.KERNEL32(018FE180), ref: 006C09CF
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                    • String ID:
                                                                                    • API String ID: 3495660284-0
                                                                                    • Opcode ID: ea8dbee36d59a0e9964a06365e057a2ee1bed56c945abceba360f5a3a5cb9d8e
                                                                                    • Instruction ID: 5b3a3d18d3576d327ddb0c2df4ff3b31ce8c52617e98cd693e454ecb3151e46d
                                                                                    • Opcode Fuzzy Hash: ea8dbee36d59a0e9964a06365e057a2ee1bed56c945abceba360f5a3a5cb9d8e
                                                                                    • Instruction Fuzzy Hash: A6F01932442B42EFE7415BA4EEC8BE6BA2AFF01712F403025F202988A0C7749566DF90
                                                                                    Function 00655D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetClientRect.USER32(?,?), ref: 00655D30
                                                                                    • GetWindowRect.USER32(?,?), ref: 00655D71
                                                                                    • ScreenToClient.USER32(?,?), ref: 00655D99
                                                                                    • GetClientRect.USER32(?,?), ref: 00655ED7
                                                                                    • GetWindowRect.USER32(?,?), ref: 00655EF8
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Rect$Client$Window$Screen
                                                                                    • String ID:
                                                                                    • API String ID: 1296646539-0
                                                                                    • Opcode ID: 9009316f2c7514d3c4cbf6d3f7248f0ddb9675239266dcf452cc7e48ff71ed44
                                                                                    • Instruction ID: a4027decc22a9248d93b25e785f1db1da408c06a789090dfb89dbd541c00f277
                                                                                    • Opcode Fuzzy Hash: 9009316f2c7514d3c4cbf6d3f7248f0ddb9675239266dcf452cc7e48ff71ed44
                                                                                    • Instruction Fuzzy Hash: 42B18C34A0074ADBCF10CFA8C485BEAB7F6FF44310F14851AE8AAD7650DB30AA46CB50
                                                                                    Function 006801B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __allrem.LIBCMT ref: 006800BA
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006800D6
                                                                                    • __allrem.LIBCMT ref: 006800ED
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0068010B
                                                                                    • __allrem.LIBCMT ref: 00680122
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00680140
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                    • String ID:
                                                                                    • API String ID: 1992179935-0
                                                                                    • Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                                                    • Instruction ID: 2edfdbb676fde14f8d816cfe05edeccf2079e22090ae4bcc4ba70f3c592e3fa6
                                                                                    • Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                                                    • Instruction Fuzzy Hash: 66810572A007069BE760AF68CC41BAB73EBAF41334F24863EF555DA781EB74D9048754
                                                                                    Function 006D1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006D3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,006D101C,00000000,?,?,00000000), ref: 006D3195
                                                                                    • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 006D1DC0
                                                                                    • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 006D1DE1
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D1DF2
                                                                                    • inet_ntoa.WSOCK32(?), ref: 006D1E8C
                                                                                    • htons.WSOCK32(?,?,?,?,?), ref: 006D1EDB
                                                                                    • _strlen.LIBCMT ref: 006D1F35
                                                                                      • Part of subcall function 006B39E8: _strlen.LIBCMT ref: 006B39F2
                                                                                      • Part of subcall function 00656D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0066CF58,?,?,?), ref: 00656DBA
                                                                                      • Part of subcall function 00656D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0066CF58,?,?,?), ref: 00656DED
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
                                                                                    • String ID:
                                                                                    • API String ID: 1923757996-0
                                                                                    • Opcode ID: 97de400ee0036522be0497c32309a926acc7e169420260e6722a5a117c64afc1
                                                                                    • Instruction ID: ec7bc9ec3562fa33a5457726d0e940aafcc44f9c685d6991d27292559ea31517
                                                                                    • Opcode Fuzzy Hash: 97de400ee0036522be0497c32309a926acc7e169420260e6722a5a117c64afc1
                                                                                    • Instruction Fuzzy Hash: 85A1DE30A04340AFC324DF20C895E6A7BE6AF85318F54894DF4565F3A2DB71ED46CB92
                                                                                    Function 006861FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006782D9,006782D9,?,?,?,0068644F,00000001,00000001,8BE85006), ref: 00686258
                                                                                    • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0068644F,00000001,00000001,8BE85006,?,?,?), ref: 006862DE
                                                                                    • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006863D8
                                                                                    • __freea.LIBCMT ref: 006863E5
                                                                                      • Part of subcall function 00683820: RtlAllocateHeap.NTDLL(00000000,?,00721444,?,0066FDF5,?,?,0065A976,00000010,00721440,006513FC,?,006513C6,?,00651129), ref: 00683852
                                                                                    • __freea.LIBCMT ref: 006863EE
                                                                                    • __freea.LIBCMT ref: 00686413
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 1414292761-0
                                                                                    • Opcode ID: 9c9e724a8d92ef1cf0df36d1ab7eb41dd39397ad93e6920a376da5af6b7f9639
                                                                                    • Instruction ID: b32204b5dc9a8772061b7f13cee0619ff99c33538dd656e77d81db5bf122d9d9
                                                                                    • Opcode Fuzzy Hash: 9c9e724a8d92ef1cf0df36d1ab7eb41dd39397ad93e6920a376da5af6b7f9639
                                                                                    • Instruction Fuzzy Hash: AB51D072A00216ABEB25AF64CC81EEF77ABEB44710F144769FD05DA240EB34DD41C7A0
                                                                                    Function 006DBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006DC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006DB6AE,?,?), ref: 006DC9B5
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DC9F1
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DCA68
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DCA9E
                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006DBCCA
                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006DBD25
                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 006DBD6A
                                                                                    • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 006DBD99
                                                                                    • RegCloseKey.ADVAPI32(?,?,00000000), ref: 006DBDF3
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 006DBDFF
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                                    • String ID:
                                                                                    • API String ID: 1120388591-0
                                                                                    • Opcode ID: 61af6bfae014d3e8563ab5fcf72535bb0ba92063032c084d9ee49a28b882d3f0
                                                                                    • Instruction ID: 6def72fc166dab73957f0a99e2bf84a1ff24d1e9448c47c9bc5b69cca2b71e44
                                                                                    • Opcode Fuzzy Hash: 61af6bfae014d3e8563ab5fcf72535bb0ba92063032c084d9ee49a28b882d3f0
                                                                                    • Instruction Fuzzy Hash: E6816930608241EFC714DF24C881E6ABBE6BF84308F15995DF4558B3A2DB32ED09CB92
                                                                                    Function 006AF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VariantInit.OLEAUT32(00000035), ref: 006AF7B9
                                                                                    • SysAllocString.OLEAUT32(00000001), ref: 006AF860
                                                                                    • VariantCopy.OLEAUT32(006AFA64,00000000), ref: 006AF889
                                                                                    • VariantClear.OLEAUT32(006AFA64), ref: 006AF8AD
                                                                                    • VariantCopy.OLEAUT32(006AFA64,00000000), ref: 006AF8B1
                                                                                    • VariantClear.OLEAUT32(?), ref: 006AF8BB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Variant$ClearCopy$AllocInitString
                                                                                    • String ID:
                                                                                    • API String ID: 3859894641-0
                                                                                    • Opcode ID: 38b4b0651fdd9fc6f1e56cec35d9eb9a050ec86c533aa707270f81854ae2d177
                                                                                    • Instruction ID: 2dc9b44bfd0c027cd08dbaa798deaaa3e12935e17c74d14e3b3b0976a7c43017
                                                                                    • Opcode Fuzzy Hash: 38b4b0651fdd9fc6f1e56cec35d9eb9a050ec86c533aa707270f81854ae2d177
                                                                                    • Instruction Fuzzy Hash: 1A51C531900310EACF50BBA5D895B6AB3E7EF46310F24546AE805DF291DB709C41CF9B
                                                                                    Function 006C910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00657620: _wcslen.LIBCMT ref: 00657625
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                    • GetOpenFileNameW.COMDLG32(00000058), ref: 006C94E5
                                                                                    • _wcslen.LIBCMT ref: 006C9506
                                                                                    • _wcslen.LIBCMT ref: 006C952D
                                                                                    • GetSaveFileNameW.COMDLG32(00000058), ref: 006C9585
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$FileName$OpenSave
                                                                                    • String ID: X
                                                                                    • API String ID: 83654149-3081909835
                                                                                    • Opcode ID: 89840f34d9d593f70c79d3b2b12247d2cea1db9e540944cfdee9feabfae4341e
                                                                                    • Instruction ID: 7f4bda11727c172d26856116355da26e1b3e1f9b8ef4b3b0a9dfb2b1d8d8199f
                                                                                    • Opcode Fuzzy Hash: 89840f34d9d593f70c79d3b2b12247d2cea1db9e540944cfdee9feabfae4341e
                                                                                    • Instruction Fuzzy Hash: F4E16B315043509FC764EF24C885B6AB7E6FF85314F04896DE8899B3A2DB31DD05CBA6
                                                                                    Function 0066920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00669BB2
                                                                                    • BeginPaint.USER32(?,?,?), ref: 00669241
                                                                                    • GetWindowRect.USER32(?,?), ref: 006692A5
                                                                                    • ScreenToClient.USER32(?,?), ref: 006692C2
                                                                                    • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 006692D3
                                                                                    • EndPaint.USER32(?,?,?,?,?), ref: 00669321
                                                                                    • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 006A71EA
                                                                                      • Part of subcall function 00669339: BeginPath.GDI32(00000000), ref: 00669357
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                                                    • String ID:
                                                                                    • API String ID: 3050599898-0
                                                                                    • Opcode ID: 8cbb120e087f4e646a8da2c093dcf5a36cd590e8eabf2bdbac3e5ec7d93dd104
                                                                                    • Instruction ID: 4a1368a7bf49b869aecdf29662daac3065ea43925c2bc582ffedea018bac10a6
                                                                                    • Opcode Fuzzy Hash: 8cbb120e087f4e646a8da2c093dcf5a36cd590e8eabf2bdbac3e5ec7d93dd104
                                                                                    • Instruction Fuzzy Hash: 6F41AC70104340AFD721DF24CC94FAA7BEAFB96320F040229F9949B2A1C734AC46DB65
                                                                                    Function 006C07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InterlockedExchange.KERNEL32(?,000001F5), ref: 006C080C
                                                                                    • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 006C0847
                                                                                    • EnterCriticalSection.KERNEL32(?), ref: 006C0863
                                                                                    • LeaveCriticalSection.KERNEL32(?), ref: 006C08DC
                                                                                    • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 006C08F3
                                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 006C0921
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                                    • String ID:
                                                                                    • API String ID: 3368777196-0
                                                                                    • Opcode ID: 7b74cdc41e4adb6c23f3602d9b13340ce30ae1fc3e77dac5fed0965d7152b3d6
                                                                                    • Instruction ID: ca6db8dbbe88ce4fbc26ea997eba1c088e6671a81c7c62b85ae5bfa1e50efc6b
                                                                                    • Opcode Fuzzy Hash: 7b74cdc41e4adb6c23f3602d9b13340ce30ae1fc3e77dac5fed0965d7152b3d6
                                                                                    • Instruction Fuzzy Hash: 3A415971900205EFEF14AF54DC85AAA7B7AFF04310F1480A9ED049E296DB31DE61DBA4
                                                                                    Function 006E81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,006AF3AB,00000000,?,?,00000000,?,006A682C,00000004,00000000,00000000), ref: 006E824C
                                                                                    • EnableWindow.USER32(?,00000000), ref: 006E8272
                                                                                    • ShowWindow.USER32(FFFFFFFF,00000000), ref: 006E82D1
                                                                                    • ShowWindow.USER32(?,00000004), ref: 006E82E5
                                                                                    • EnableWindow.USER32(?,00000001), ref: 006E830B
                                                                                    • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 006E832F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Show$Enable$MessageSend
                                                                                    • String ID:
                                                                                    • API String ID: 642888154-0
                                                                                    • Opcode ID: 7ab3449334e8951350dede73e4c0df8df3df3dd506f0589c834fb8ca7cbc17c7
                                                                                    • Instruction ID: 52e0472447bf49a69f147987b656b3c88df01a54e526d2820cd7a14d9182a766
                                                                                    • Opcode Fuzzy Hash: 7ab3449334e8951350dede73e4c0df8df3df3dd506f0589c834fb8ca7cbc17c7
                                                                                    • Instruction Fuzzy Hash: C841D7306027C0AFDF25CF56C895BE47BE2BB06714F1851A8E64C4F3A2C7326946CB84
                                                                                    Function 006B4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsWindowVisible.USER32(?), ref: 006B4C95
                                                                                    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 006B4CB2
                                                                                    • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 006B4CEA
                                                                                    • _wcslen.LIBCMT ref: 006B4D08
                                                                                    • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 006B4D10
                                                                                    • _wcsstr.LIBVCRUNTIME ref: 006B4D1A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                                                    • String ID:
                                                                                    • API String ID: 72514467-0
                                                                                    • Opcode ID: ef76e79fd45f530786206469eb30e3fa3cb8883edcc1bfc0075fa18256d99dd9
                                                                                    • Instruction ID: 24ba80b9dd4e30e475411909f1dad06cb8426364035fe63623d88464fd6a871c
                                                                                    • Opcode Fuzzy Hash: ef76e79fd45f530786206469eb30e3fa3cb8883edcc1bfc0075fa18256d99dd9
                                                                                    • Instruction Fuzzy Hash: 7121A7726042507BEB155B29EC49EBB7FAADF45760F10802DF805CA292EF61DC4197A0
                                                                                    Function 006C581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00653AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00653A97,?,?,00652E7F,?,?,?,00000000), ref: 00653AC2
                                                                                    • _wcslen.LIBCMT ref: 006C587B
                                                                                    • CoInitialize.OLE32(00000000), ref: 006C5995
                                                                                    • CoCreateInstance.OLE32(006EFCF8,00000000,00000001,006EFB68,?), ref: 006C59AE
                                                                                    • CoUninitialize.OLE32 ref: 006C59CC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                                                    • String ID: .lnk
                                                                                    • API String ID: 3172280962-24824748
                                                                                    • Opcode ID: b7b3b0367ff1a7da2b794130638f3db92f90df4255126c2349ef0dd368bc16ec
                                                                                    • Instruction ID: 9485d778c05e363e9979d706ab713437b830adb983cdc4361c29b2caaa0718e3
                                                                                    • Opcode Fuzzy Hash: b7b3b0367ff1a7da2b794130638f3db92f90df4255126c2349ef0dd368bc16ec
                                                                                    • Instruction Fuzzy Hash: 5ED154756047019FC714DF24C890E6ABBE2EF89710F14895DF88A9B361DB31ED89CB92
                                                                                    Function 006B175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006B0FCA
                                                                                      • Part of subcall function 006B0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006B0FD6
                                                                                      • Part of subcall function 006B0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006B0FE5
                                                                                      • Part of subcall function 006B0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006B0FEC
                                                                                      • Part of subcall function 006B0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006B1002
                                                                                    • GetLengthSid.ADVAPI32(?,00000000,006B1335), ref: 006B17AE
                                                                                    • GetProcessHeap.KERNEL32(00000008,00000000), ref: 006B17BA
                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 006B17C1
                                                                                    • CopySid.ADVAPI32(00000000,00000000,?), ref: 006B17DA
                                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,006B1335), ref: 006B17EE
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B17F5
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                                                    • String ID:
                                                                                    • API String ID: 3008561057-0
                                                                                    • Opcode ID: 0b00272ced2e467e134e1a73c025694546506d800654a49d0d306d74af491bb8
                                                                                    • Instruction ID: 8b5e38946ee3521ce7a490346eb69c9d7f5c5e9d47e585b22a6848022007f8c0
                                                                                    • Opcode Fuzzy Hash: 0b00272ced2e467e134e1a73c025694546506d800654a49d0d306d74af491bb8
                                                                                    • Instruction Fuzzy Hash: 3911AFB2510205FFDB109FA4CC99BEE7BAAEB42365F504028F8419B250CB369A81DB60
                                                                                    Function 006B14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006B14FF
                                                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 006B1506
                                                                                    • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 006B1515
                                                                                    • CloseHandle.KERNEL32(00000004), ref: 006B1520
                                                                                    • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006B154F
                                                                                    • DestroyEnvironmentBlock.USERENV(00000000), ref: 006B1563
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                    • String ID:
                                                                                    • API String ID: 1413079979-0
                                                                                    • Opcode ID: 4995124c6e5e68008240368b4823ce2ca79dcecc721e017003fcc7d0e8fffaa2
                                                                                    • Instruction ID: 1f30a37d7ef7e8b6c6ea2ad4a961299c1c2d321d58be21d9dc64c75e37fae89f
                                                                                    • Opcode Fuzzy Hash: 4995124c6e5e68008240368b4823ce2ca79dcecc721e017003fcc7d0e8fffaa2
                                                                                    • Instruction Fuzzy Hash: 281117B2500249BBDF11CF98DD49BDE7BAAEB49754F044025FA05AA160C3768EA19B60
                                                                                    Function 00673382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(?,?,00673379,00672FE5), ref: 00673390
                                                                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0067339E
                                                                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006733B7
                                                                                    • SetLastError.KERNEL32(00000000,?,00673379,00672FE5), ref: 00673409
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorLastValue___vcrt_
                                                                                    • String ID:
                                                                                    • API String ID: 3852720340-0
                                                                                    • Opcode ID: 80f02c5e7972d810e386adabb38cb5209ab7ff3b2bfdb45914f17731a83f0c19
                                                                                    • Instruction ID: 550cc82524e9a17948f5d8702997c27af61337cbdd62c12c20519af4a5f7a83a
                                                                                    • Opcode Fuzzy Hash: 80f02c5e7972d810e386adabb38cb5209ab7ff3b2bfdb45914f17731a83f0c19
                                                                                    • Instruction Fuzzy Hash: 1B01B132649331AEAA6627B86C859A62A97EB19379720C32DF528853F0EF114D027658
                                                                                    Function 00682D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(?,?,00685686,00693CD6,?,00000000,?,00685B6A,?,?,?,?,?,0067E6D1,?,00718A48), ref: 00682D78
                                                                                    • _free.LIBCMT ref: 00682DAB
                                                                                    • _free.LIBCMT ref: 00682DD3
                                                                                    • SetLastError.KERNEL32(00000000,?,?,?,?,0067E6D1,?,00718A48,00000010,00654F4A,?,?,00000000,00693CD6), ref: 00682DE0
                                                                                    • SetLastError.KERNEL32(00000000,?,?,?,?,0067E6D1,?,00718A48,00000010,00654F4A,?,?,00000000,00693CD6), ref: 00682DEC
                                                                                    • _abort.LIBCMT ref: 00682DF2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_free$_abort
                                                                                    • String ID:
                                                                                    • API String ID: 3160817290-0
                                                                                    • Opcode ID: b4759e3029b13029c8278f47b574bf4d98ab72d9b8cbc193b214ef787143d8bf
                                                                                    • Instruction ID: 9c8cb6cfa975cc14bc704dcfaa704449709639dbe912e07ae6cdd468c101c86b
                                                                                    • Opcode Fuzzy Hash: b4759e3029b13029c8278f47b574bf4d98ab72d9b8cbc193b214ef787143d8bf
                                                                                    • Instruction Fuzzy Hash: 3EF0287664560377C7523338BC3AE9B295BAFC1BB0F21431CF824923D2EF2888025364
                                                                                    Function 006E8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00669693
                                                                                      • Part of subcall function 00669639: SelectObject.GDI32(?,00000000), ref: 006696A2
                                                                                      • Part of subcall function 00669639: BeginPath.GDI32(?), ref: 006696B9
                                                                                      • Part of subcall function 00669639: SelectObject.GDI32(?,00000000), ref: 006696E2
                                                                                    • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 006E8A4E
                                                                                    • LineTo.GDI32(?,00000003,00000000), ref: 006E8A62
                                                                                    • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 006E8A70
                                                                                    • LineTo.GDI32(?,00000000,00000003), ref: 006E8A80
                                                                                    • EndPath.GDI32(?), ref: 006E8A90
                                                                                    • StrokePath.GDI32(?), ref: 006E8AA0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                                    • String ID:
                                                                                    • API String ID: 43455801-0
                                                                                    • Opcode ID: 1bb1fbeae8bd3a4aaa0f0dc7af12a7d313b815a59a058b55006f1813af21fa13
                                                                                    • Instruction ID: 503aa8c4820ca5f5c777334a71f57c08b0e59a47ccd6d745eb760b21da344541
                                                                                    • Opcode Fuzzy Hash: 1bb1fbeae8bd3a4aaa0f0dc7af12a7d313b815a59a058b55006f1813af21fa13
                                                                                    • Instruction Fuzzy Hash: 10110C7600028CFFDF129F94DC88EDA7F6DEB04364F008025FA199A161C772AD56DB60
                                                                                    Function 006B51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetDC.USER32(00000000), ref: 006B5218
                                                                                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 006B5229
                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 006B5230
                                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 006B5238
                                                                                    • MulDiv.KERNEL32(000009EC,?,00000000), ref: 006B524F
                                                                                    • MulDiv.KERNEL32(000009EC,00000001,?), ref: 006B5261
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CapsDevice$Release
                                                                                    • String ID:
                                                                                    • API String ID: 1035833867-0
                                                                                    • Opcode ID: 9eba4dce7ebef2ce0f1daf29ad26bfae66b0fe7dba3ce2ca80f16a5da696251d
                                                                                    • Instruction ID: 9041dcea4e425d532fbedd17a6c7f111c899bec1e95ce7782c9c7e18d7f35f11
                                                                                    • Opcode Fuzzy Hash: 9eba4dce7ebef2ce0f1daf29ad26bfae66b0fe7dba3ce2ca80f16a5da696251d
                                                                                    • Instruction Fuzzy Hash: A0018475A01704BBEB109BE59C49F8EBF79EB44761F044065FA05AB280D6709D01CF60
                                                                                    Function 00651BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00651BF4
                                                                                    • MapVirtualKeyW.USER32(00000010,00000000), ref: 00651BFC
                                                                                    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00651C07
                                                                                    • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00651C12
                                                                                    • MapVirtualKeyW.USER32(00000011,00000000), ref: 00651C1A
                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00651C22
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Virtual
                                                                                    • String ID:
                                                                                    • API String ID: 4278518827-0
                                                                                    • Opcode ID: 559f6d6a1dcba2d09df388faa8de68366a1aeffa6d64da1bf7e9b619ed9f06bf
                                                                                    • Instruction ID: fca4dd7a7d7bbee980f9ac01a0bd7816e8ce7e9175e2e0740a9b58b9bfc155e5
                                                                                    • Opcode Fuzzy Hash: 559f6d6a1dcba2d09df388faa8de68366a1aeffa6d64da1bf7e9b619ed9f06bf
                                                                                    • Instruction Fuzzy Hash: 860144B0902B5ABDE3008F6A8C85A52FFA8FF19354F00411BA15C4BA42C7B5A864CBE5
                                                                                    Function 006BEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 006BEB30
                                                                                    • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 006BEB46
                                                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 006BEB55
                                                                                    • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006BEB64
                                                                                    • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006BEB6E
                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006BEB75
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                    • String ID:
                                                                                    • API String ID: 839392675-0
                                                                                    • Opcode ID: 49f2f47023b18899716082c0f99dc2d15f90456cb0c853ddf1b771b3192c0d77
                                                                                    • Instruction ID: 9d87f6969409cbdc8d22e339ca19aedd080018247697d6a30c355086d47187be
                                                                                    • Opcode Fuzzy Hash: 49f2f47023b18899716082c0f99dc2d15f90456cb0c853ddf1b771b3192c0d77
                                                                                    • Instruction Fuzzy Hash: BDF05E72240698BFE7215B629C4EEEF3F7DEFCAB21F001158FA01D9191D7A05A02C6B5
                                                                                    Function 006A7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetClientRect.USER32(?), ref: 006A7452
                                                                                    • SendMessageW.USER32(?,00001328,00000000,?), ref: 006A7469
                                                                                    • GetWindowDC.USER32(?), ref: 006A7475
                                                                                    • GetPixel.GDI32(00000000,?,?), ref: 006A7484
                                                                                    • ReleaseDC.USER32(?,00000000), ref: 006A7496
                                                                                    • GetSysColor.USER32(00000005), ref: 006A74B0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                                                    • String ID:
                                                                                    • API String ID: 272304278-0
                                                                                    • Opcode ID: 7a30acd7b2532b250dec3f44129285461fccc56c5ef44b3ed12bd61401495541
                                                                                    • Instruction ID: e648fec296ab67dd251a38e27cc1fc9ca7e11576022a2c06e634523236e8de0d
                                                                                    • Opcode Fuzzy Hash: 7a30acd7b2532b250dec3f44129285461fccc56c5ef44b3ed12bd61401495541
                                                                                    • Instruction Fuzzy Hash: FF018B31400255EFDB106F64DC48BEE7BB7FB08321F505064F926A61A1CB312E53AF10
                                                                                    Function 006B1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 006B187F
                                                                                    • UnloadUserProfile.USERENV(?,?), ref: 006B188B
                                                                                    • CloseHandle.KERNEL32(?), ref: 006B1894
                                                                                    • CloseHandle.KERNEL32(?), ref: 006B189C
                                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 006B18A5
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B18AC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                    • String ID:
                                                                                    • API String ID: 146765662-0
                                                                                    • Opcode ID: 1ca578b6c25a815b1d4ed139085ff398562016deea2e9970eb726965e5b19af9
                                                                                    • Instruction ID: e0a00e4bc43f7f1b0c93e795e1cba52c0fa9600bae87f8cdb2bdeef1681bd39f
                                                                                    • Opcode Fuzzy Hash: 1ca578b6c25a815b1d4ed139085ff398562016deea2e9970eb726965e5b19af9
                                                                                    • Instruction Fuzzy Hash: 67E0E536014B41BBDB015FA1ED4C94ABF3AFF4AB32B109220F625890B0CB329422EF50
                                                                                    Function 0065BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __Init_thread_footer.LIBCMT ref: 0065BEB3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Init_thread_footer
                                                                                    • String ID: D%r$D%r$D%r$D%rD%r
                                                                                    • API String ID: 1385522511-2839123534
                                                                                    • Opcode ID: e19a3c6796092ae0d3d4578fe5461d9231c3f6e4400c52195ebfd6dc3671f143
                                                                                    • Instruction ID: 7f3460fdca1e43d246c9e2c4682f2b3674c840b868c991fef5c69116b2fcecc7
                                                                                    • Opcode Fuzzy Hash: e19a3c6796092ae0d3d4578fe5461d9231c3f6e4400c52195ebfd6dc3671f143
                                                                                    • Instruction Fuzzy Hash: 82916875A0020ADFCB18CF59C0916AAB7F2FF58311F24916EE941AB351E731E986CB94
                                                                                    Function 006D7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00670242: EnterCriticalSection.KERNEL32(0072070C,00721884,?,?,0066198B,00722518,?,?,?,006512F9,00000000), ref: 0067024D
                                                                                      • Part of subcall function 00670242: LeaveCriticalSection.KERNEL32(0072070C,?,0066198B,00722518,?,?,?,006512F9,00000000), ref: 0067028A
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006700A3: __onexit.LIBCMT ref: 006700A9
                                                                                    • __Init_thread_footer.LIBCMT ref: 006D7BFB
                                                                                      • Part of subcall function 006701F8: EnterCriticalSection.KERNEL32(0072070C,?,?,00668747,00722514), ref: 00670202
                                                                                      • Part of subcall function 006701F8: LeaveCriticalSection.KERNEL32(0072070C,?,00668747,00722514), ref: 00670235
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                                                    • String ID: +Tj$5$G$Variable must be of type 'Object'.
                                                                                    • API String ID: 535116098-1733505454
                                                                                    • Opcode ID: a83f8748adee8820471a5f407d298bb126ba9318e31cd9c0940cbcd0a2d03cbe
                                                                                    • Instruction ID: 1609d4317e32fa9fbb81e219d220cc808c15093f4588e926c7840f582422c9ba
                                                                                    • Opcode Fuzzy Hash: a83f8748adee8820471a5f407d298bb126ba9318e31cd9c0940cbcd0a2d03cbe
                                                                                    • Instruction Fuzzy Hash: C5915B74A04209EFCB14EF94D8919ADB7B3EF45300F10805EF846AB392EB71AE45CB56
                                                                                    Function 006BC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00657620: _wcslen.LIBCMT ref: 00657625
                                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006BC6EE
                                                                                    • _wcslen.LIBCMT ref: 006BC735
                                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006BC79C
                                                                                    • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 006BC7CA
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ItemMenu$Info_wcslen$Default
                                                                                    • String ID: 0
                                                                                    • API String ID: 1227352736-4108050209
                                                                                    • Opcode ID: bc1107b71b44883d945081e7741ee89f49aed23f9d705602eac1b9b69cb5b832
                                                                                    • Instruction ID: 277931e8f99e02b3da72035819d8733bfb3bcf9787424a9ef3776fcb6f0e3af4
                                                                                    • Opcode Fuzzy Hash: bc1107b71b44883d945081e7741ee89f49aed23f9d705602eac1b9b69cb5b832
                                                                                    • Instruction Fuzzy Hash: AA51D0F16043409BD754DF28C885BEB77EAAF49320F040A3DF995D3290EB64DA84CB56
                                                                                    Function 006B719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 006B7206
                                                                                    • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 006B723C
                                                                                    • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 006B724D
                                                                                    • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 006B72CF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorMode$AddressCreateInstanceProc
                                                                                    • String ID: DllGetClassObject
                                                                                    • API String ID: 753597075-1075368562
                                                                                    • Opcode ID: 1cca060fd5b3a98ab994a85559c279dc1b7733071d8bb85340793fc63a4c04b0
                                                                                    • Instruction ID: be4d612a05a9f0d8638f23c3128e0ac106aa79ab496acfbd5c7b0d68e7980893
                                                                                    • Opcode Fuzzy Hash: 1cca060fd5b3a98ab994a85559c279dc1b7733071d8bb85340793fc63a4c04b0
                                                                                    • Instruction Fuzzy Hash: DA4141B1A04204EFDB15CF54C884ADA7BAAEF84311F1580ADFD059F24AD7B1DA85CBA0
                                                                                    Function 006E3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006E3E35
                                                                                    • IsMenu.USER32(?), ref: 006E3E4A
                                                                                    • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006E3E92
                                                                                    • DrawMenuBar.USER32 ref: 006E3EA5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Menu$Item$DrawInfoInsert
                                                                                    • String ID: 0
                                                                                    • API String ID: 3076010158-4108050209
                                                                                    • Opcode ID: 17860a157da59c081bdfa4ed9476e1ebd484413387efee4e0e370591d0ea83fb
                                                                                    • Instruction ID: c4409e746bc80e80b674ae0560cd8ee1f52bdcf760c1965765e1aea122c8350c
                                                                                    • Opcode Fuzzy Hash: 17860a157da59c081bdfa4ed9476e1ebd484413387efee4e0e370591d0ea83fb
                                                                                    • Instruction Fuzzy Hash: BF417974A02399AFDB14DF51D888AEABBB6FF48360F04412AE905AB350C330AE51CF50
                                                                                    Function 006B1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006B3CCA
                                                                                    • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 006B1E66
                                                                                    • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 006B1E79
                                                                                    • SendMessageW.USER32(?,00000189,?,00000000), ref: 006B1EA9
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$_wcslen$ClassName
                                                                                    • String ID: ComboBox$ListBox
                                                                                    • API String ID: 2081771294-1403004172
                                                                                    • Opcode ID: 2f628949ec5604a117f0d059f8d76f6671f6f3f0a94622745b4db63f85b604b2
                                                                                    • Instruction ID: cf26c4eb80e7075122c70acfd5c052587fe369b6f7cb70f61b88e7f5d101d6c4
                                                                                    • Opcode Fuzzy Hash: 2f628949ec5604a117f0d059f8d76f6671f6f3f0a94622745b4db63f85b604b2
                                                                                    • Instruction Fuzzy Hash: DD21E4B1A00144BADB189BA4DC95CFFBBBBDF46360B50451DFC15AB2E1DB34894A8720
                                                                                    Function 006DC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen
                                                                                    • String ID: HKEY_LOCAL_MACHINE$HKLM
                                                                                    • API String ID: 176396367-4004644295
                                                                                    • Opcode ID: 1b26eab23abedc81eab40f8d94d3f67390699fb72c01b73b51fd04acdff6897d
                                                                                    • Instruction ID: 706393ea711c2ed3176bffcd7128cf5b4a0c04c5bc4fb8cb62364fa775d4b873
                                                                                    • Opcode Fuzzy Hash: 1b26eab23abedc81eab40f8d94d3f67390699fb72c01b73b51fd04acdff6897d
                                                                                    • Instruction Fuzzy Hash: C231C372E0016F8BCB20DE6C89505FE33A35BA1760B19402BE845AB385EA71CE84D3A4
                                                                                    Function 006E2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 006E2F8D
                                                                                    • LoadLibraryW.KERNEL32(?), ref: 006E2F94
                                                                                    • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 006E2FA9
                                                                                    • DestroyWindow.USER32(?), ref: 006E2FB1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                    • String ID: SysAnimate32
                                                                                    • API String ID: 3529120543-1011021900
                                                                                    • Opcode ID: 3ad1d0cedd8bb36bf703a9567777e888f1c03e58c5620517fb661b39e9303e9b
                                                                                    • Instruction ID: 93650a507bcce96dad22f6a2fb0c43f98607a098f0b69c9af229b1cd4ce1de70
                                                                                    • Opcode Fuzzy Hash: 3ad1d0cedd8bb36bf703a9567777e888f1c03e58c5620517fb661b39e9303e9b
                                                                                    • Instruction Fuzzy Hash: AA21DE72241386ABEB104F65DCA0EBB37BFFB58324F100218F910D6290D771DC529760
                                                                                    Function 00674D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00674D1E,006828E9,?,00674CBE,006828E9,007188B8,0000000C,00674E15,006828E9,00000002), ref: 00674D8D
                                                                                    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00674DA0
                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,00674D1E,006828E9,?,00674CBE,006828E9,007188B8,0000000C,00674E15,006828E9,00000002,00000000), ref: 00674DC3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                                                    • String ID: CorExitProcess$mscoree.dll
                                                                                    • API String ID: 4061214504-1276376045
                                                                                    • Opcode ID: 32af16c18c30271af49aa157bbdfd625a9e1bb9acc083aa080bf4418f2f7a5af
                                                                                    • Instruction ID: 5158815645e94c5f01f25b29c3d725084d88a34e85f9b905a78e33d34b787e4f
                                                                                    • Opcode Fuzzy Hash: 32af16c18c30271af49aa157bbdfd625a9e1bb9acc083aa080bf4418f2f7a5af
                                                                                    • Instruction Fuzzy Hash: 21F04434540348FBDB115F94DC49BEDBFB7EF44751F014198F909A6251DF305941CA94
                                                                                    Function 00654E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00654EDD,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654E9C
                                                                                    • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00654EAE
                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,00654EDD,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654EC0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Library$AddressFreeLoadProc
                                                                                    • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                                    • API String ID: 145871493-3689287502
                                                                                    • Opcode ID: f795bdee2c4327c94e3c4c4e247302d53b681fd24f892376cd9415c684225371
                                                                                    • Instruction ID: a18d03b831a1802b56c1d840c189c8198b996871f45a5ecd0071dba6e55881ef
                                                                                    • Opcode Fuzzy Hash: f795bdee2c4327c94e3c4c4e247302d53b681fd24f892376cd9415c684225371
                                                                                    • Instruction Fuzzy Hash: CEE08635A027225BD3211725AC19ADB6557AF82F77B050155FC00D7240DF64CD4640A0
                                                                                    Function 00654E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00693CDE,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654E62
                                                                                    • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00654E74
                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,00693CDE,?,00721418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00654E87
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Library$AddressFreeLoadProc
                                                                                    • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                                    • API String ID: 145871493-1355242751
                                                                                    • Opcode ID: 5cc6b7a0af3498aadedbb5a3697e2bf79997321be4e18b999c3f083ef976733c
                                                                                    • Instruction ID: 3dd9e726289044dc362546ab1eaaca6fa4948e671973aa52976edb84b0f08e74
                                                                                    • Opcode Fuzzy Hash: 5cc6b7a0af3498aadedbb5a3697e2bf79997321be4e18b999c3f083ef976733c
                                                                                    • Instruction Fuzzy Hash: DBD0C23190276157C7221B256C09DCB2A1BAF81F363050154BC00A6210CF20CD4681D0
                                                                                    Function 006C2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006C2C05
                                                                                    • DeleteFileW.KERNEL32(?), ref: 006C2C87
                                                                                    • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 006C2C9D
                                                                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006C2CAE
                                                                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006C2CC0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: File$Delete$Copy
                                                                                    • String ID:
                                                                                    • API String ID: 3226157194-0
                                                                                    • Opcode ID: 46f8d2c68f02113f391d3243041ab4e46e35b14ded1c88d2f1b7f5d05d61091d
                                                                                    • Instruction ID: 4ab3bab4b5c458864c7ef19a617d28bbded4d81e3badd815dcef5ed29f817341
                                                                                    • Opcode Fuzzy Hash: 46f8d2c68f02113f391d3243041ab4e46e35b14ded1c88d2f1b7f5d05d61091d
                                                                                    • Instruction Fuzzy Hash: 78B15071D00119ABDF51DBA4CC95EEEB7BEEF48350F1040AEFA09E6141EA319A448F65
                                                                                    Function 006DA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentProcessId.KERNEL32 ref: 006DA427
                                                                                    • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 006DA435
                                                                                    • GetProcessIoCounters.KERNEL32(00000000,?), ref: 006DA468
                                                                                    • CloseHandle.KERNEL32(?), ref: 006DA63D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                    • String ID:
                                                                                    • API String ID: 3488606520-0
                                                                                    • Opcode ID: 717d6ca95539785d72cfcd2d8927df8be061c271c0ed66d694b34ef82eab1f9e
                                                                                    • Instruction ID: a49af294acb2d52f47282e01cb05abc4db56f93efbb523a2c87afea7dc4aba1b
                                                                                    • Opcode Fuzzy Hash: 717d6ca95539785d72cfcd2d8927df8be061c271c0ed66d694b34ef82eab1f9e
                                                                                    • Instruction Fuzzy Hash: 00A1B1716043009FD760DF24D882F2AB7E6AF84714F14885DF99A9B392DBB0EC45CB96
                                                                                    Function 006BE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006BDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006BCF22,?), ref: 006BDDFD
                                                                                      • Part of subcall function 006BDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006BCF22,?), ref: 006BDE16
                                                                                      • Part of subcall function 006BE199: GetFileAttributesW.KERNEL32(?,006BCF95), ref: 006BE19A
                                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 006BE473
                                                                                    • MoveFileW.KERNEL32(?,?), ref: 006BE4AC
                                                                                    • _wcslen.LIBCMT ref: 006BE5EB
                                                                                    • _wcslen.LIBCMT ref: 006BE603
                                                                                    • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 006BE650
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                                                    • String ID:
                                                                                    • API String ID: 3183298772-0
                                                                                    • Opcode ID: 983f00cf10ced8ab9ed09929a1c555fc96cba788e30211050f27d200b8cc0980
                                                                                    • Instruction ID: 3d3c8fa2bca6165b01880d23878f436feae84393b253c0acfedbb2ffac7e6245
                                                                                    • Opcode Fuzzy Hash: 983f00cf10ced8ab9ed09929a1c555fc96cba788e30211050f27d200b8cc0980
                                                                                    • Instruction Fuzzy Hash: D05174F24083459BC764DBA4D8819DF73EEAF85340F00491EF689D3151EF75A68C876A
                                                                                    Function 006DB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006DC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006DB6AE,?,?), ref: 006DC9B5
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DC9F1
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DCA68
                                                                                      • Part of subcall function 006DC998: _wcslen.LIBCMT ref: 006DCA9E
                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006DBAA5
                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006DBB00
                                                                                    • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 006DBB63
                                                                                    • RegCloseKey.ADVAPI32(?,?), ref: 006DBBA6
                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 006DBBB3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                                                    • String ID:
                                                                                    • API String ID: 826366716-0
                                                                                    • Opcode ID: e07f6cefe26dccb8f53083d318bb129152660b32614b51946f3608ae116e2e6e
                                                                                    • Instruction ID: ac14caf8f11da9468ce8a1b11ab4820792b268ddf8d8b00493a722173334a5ad
                                                                                    • Opcode Fuzzy Hash: e07f6cefe26dccb8f53083d318bb129152660b32614b51946f3608ae116e2e6e
                                                                                    • Instruction Fuzzy Hash: F6617B31608241EFC714DF14C490E6ABBE6EF84308F15995EF4998B392DB31ED4ACB92
                                                                                    Function 006B8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VariantInit.OLEAUT32(?), ref: 006B8BCD
                                                                                    • VariantClear.OLEAUT32 ref: 006B8C3E
                                                                                    • VariantClear.OLEAUT32 ref: 006B8C9D
                                                                                    • VariantClear.OLEAUT32(?), ref: 006B8D10
                                                                                    • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 006B8D3B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Variant$Clear$ChangeInitType
                                                                                    • String ID:
                                                                                    • API String ID: 4136290138-0
                                                                                    • Opcode ID: 8c483ad8c1ff65d5279829828da6857aa8b84fd992091062cd9f0d3aacfc55dd
                                                                                    • Instruction ID: 718f6bc62086eb3a03a561ecbafb7a6c9203066b634622eb93093bb338c0a970
                                                                                    • Opcode Fuzzy Hash: 8c483ad8c1ff65d5279829828da6857aa8b84fd992091062cd9f0d3aacfc55dd
                                                                                    • Instruction Fuzzy Hash: D1516AB5A00619EFCB10CF68C894AEAB7F9FF89310B15855AE909DB350E730E911CF90
                                                                                    Function 006C8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 006C8BAE
                                                                                    • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 006C8BDA
                                                                                    • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 006C8C32
                                                                                    • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 006C8C57
                                                                                    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 006C8C5F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: PrivateProfile$SectionWrite$String
                                                                                    • String ID:
                                                                                    • API String ID: 2832842796-0
                                                                                    • Opcode ID: 1a1395e227ac8eb1042113f3fcc1775b796f72d96731e7ff77ac0879cbd222d7
                                                                                    • Instruction ID: 321cd5cdd886f27eb704b079b07dd093bc04a001fa449f7b2a4565eebad425dc
                                                                                    • Opcode Fuzzy Hash: 1a1395e227ac8eb1042113f3fcc1775b796f72d96731e7ff77ac0879cbd222d7
                                                                                    • Instruction Fuzzy Hash: 74514835A00215AFCB15DF64C881EAABBF6FF49314F08845CE849AB362DB31ED55CB94
                                                                                    Function 006D8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryW.KERNEL32(?,00000000,?), ref: 006D8F40
                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 006D8FD0
                                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 006D8FEC
                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 006D9032
                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 006D9052
                                                                                      • Part of subcall function 0066F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,006C1043,?,753CE610), ref: 0066F6E6
                                                                                      • Part of subcall function 0066F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,006AFA64,00000000,00000000,?,?,006C1043,?,753CE610,?,006AFA64), ref: 0066F70D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                                                    • String ID:
                                                                                    • API String ID: 666041331-0
                                                                                    • Opcode ID: 54de3f408af78873259f070bc729b7df6742e9cda02bf9e963f9b2ffaf5e13cd
                                                                                    • Instruction ID: 2187b0165ce771b8cc853bb7d37e2229cee253e0e6e7a8525e3bdc658087127c
                                                                                    • Opcode Fuzzy Hash: 54de3f408af78873259f070bc729b7df6742e9cda02bf9e963f9b2ffaf5e13cd
                                                                                    • Instruction Fuzzy Hash: 0B512B35A04205DFCB55DF68C4948ADBBF2FF49324F048099E8169B362DB31ED8ACB90
                                                                                    Function 006E6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetWindowLongW.USER32(00000002,000000F0,?), ref: 006E6C33
                                                                                    • SetWindowLongW.USER32(?,000000EC,?), ref: 006E6C4A
                                                                                    • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 006E6C73
                                                                                    • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,006CAB79,00000000,00000000), ref: 006E6C98
                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 006E6CC7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Long$MessageSendShow
                                                                                    • String ID:
                                                                                    • API String ID: 3688381893-0
                                                                                    • Opcode ID: 004b6de413a372640366df5b8dc2b34471228df12091cb4218e78b865a303c99
                                                                                    • Instruction ID: 65f6a10a5d3d5bae275ba22b6cd56b8e7be068455cd15a520fb746aeed66a15c
                                                                                    • Opcode Fuzzy Hash: 004b6de413a372640366df5b8dc2b34471228df12091cb4218e78b865a303c99
                                                                                    • Instruction Fuzzy Hash: B541E735601384AFD724CF2ACC94FE57BA6EB197A0F250268FC95A73E0D371AD52C640
                                                                                    Function 00682051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: a039a5181d932edd70c31237ce5a875456230aba791a56e46af15bc7d316e957
                                                                                    • Instruction ID: 3098bbfb2163abd11a1899f05b8a8e2dbfdc997b62f5af71c82aed087559713a
                                                                                    • Opcode Fuzzy Hash: a039a5181d932edd70c31237ce5a875456230aba791a56e46af15bc7d316e957
                                                                                    • Instruction Fuzzy Hash: 9E41E672A00201AFCB20EF78C894A9DB7E6EF88714F158668E615EB391D731ED01CB80
                                                                                    Function 0066912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCursorPos.USER32(?), ref: 00669141
                                                                                    • ScreenToClient.USER32(00000000,?), ref: 0066915E
                                                                                    • GetAsyncKeyState.USER32(00000001), ref: 00669183
                                                                                    • GetAsyncKeyState.USER32(00000002), ref: 0066919D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AsyncState$ClientCursorScreen
                                                                                    • String ID:
                                                                                    • API String ID: 4210589936-0
                                                                                    • Opcode ID: b6796524053806f2c149217906fc68895306027c998cc8014c2f569af268af84
                                                                                    • Instruction ID: beb10b30848a1bfd25b2a30e62807049ae81bdeaac3ea2ebe117436429b9f0a9
                                                                                    • Opcode Fuzzy Hash: b6796524053806f2c149217906fc68895306027c998cc8014c2f569af268af84
                                                                                    • Instruction Fuzzy Hash: CB41527150860AEBDF159F64C844BEEF7BAFB06324F244219E825A6290C7345D55CFA1
                                                                                    Function 006C3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetInputState.USER32 ref: 006C38CB
                                                                                    • TranslateAcceleratorW.USER32(?,00000000,?), ref: 006C3922
                                                                                    • TranslateMessage.USER32(?), ref: 006C394B
                                                                                    • DispatchMessageW.USER32(?), ref: 006C3955
                                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006C3966
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                                    • String ID:
                                                                                    • API String ID: 2256411358-0
                                                                                    • Opcode ID: 60a75360cb9426bd18e8c2cf5e3559e8c87d73396765972798011eeb99bfcbf7
                                                                                    • Instruction ID: 304a1707fd1b53791dbc9d3714e9940a90b5d37f4ab4160d6eac640aa018cd6c
                                                                                    • Opcode Fuzzy Hash: 60a75360cb9426bd18e8c2cf5e3559e8c87d73396765972798011eeb99bfcbf7
                                                                                    • Instruction Fuzzy Hash: 0E31B7709043A29EEB35CB349848FF637AAFB15304F44C56DE452C63A1F3B99686CB15
                                                                                    Function 006CCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 006CCF38
                                                                                    • InternetReadFile.WININET(?,00000000,?,?), ref: 006CCF6F
                                                                                    • GetLastError.KERNEL32(?,00000000,?,?,?,006CC21E,00000000), ref: 006CCFB4
                                                                                    • SetEvent.KERNEL32(?,?,00000000,?,?,?,006CC21E,00000000), ref: 006CCFC8
                                                                                    • SetEvent.KERNEL32(?,?,00000000,?,?,?,006CC21E,00000000), ref: 006CCFF2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                                                    • String ID:
                                                                                    • API String ID: 3191363074-0
                                                                                    • Opcode ID: e27b6ddd714dc1ce9e7ae0b6cd16e1acc575801cde0ba989621d56644dc37cf4
                                                                                    • Instruction ID: 0fd1a870bf6c788b36366a7f5b4a2adc635e6f8b0816dd7b1119b35ead14ee3a
                                                                                    • Opcode Fuzzy Hash: e27b6ddd714dc1ce9e7ae0b6cd16e1acc575801cde0ba989621d56644dc37cf4
                                                                                    • Instruction Fuzzy Hash: FE312B71904705AFDB20DFA5D884EBABBFBEF14361B10442EF52AD6251DB30AE41DB60
                                                                                    Function 006B1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetWindowRect.USER32(?,?), ref: 006B1915
                                                                                    • PostMessageW.USER32(00000001,00000201,00000001), ref: 006B19C1
                                                                                    • Sleep.KERNEL32(00000000,?,?,?), ref: 006B19C9
                                                                                    • PostMessageW.USER32(00000001,00000202,00000000), ref: 006B19DA
                                                                                    • Sleep.KERNEL32(00000000,?,?,?,?), ref: 006B19E2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessagePostSleep$RectWindow
                                                                                    • String ID:
                                                                                    • API String ID: 3382505437-0
                                                                                    • Opcode ID: bf822c77b952c29fdb3891855287dfe409e3ddbaed76cf5093ed06ad1400b38d
                                                                                    • Instruction ID: 7620409298fef2bc5d71d83b2f87fdea822ea1146348220c70132da47d447836
                                                                                    • Opcode Fuzzy Hash: bf822c77b952c29fdb3891855287dfe409e3ddbaed76cf5093ed06ad1400b38d
                                                                                    • Instruction Fuzzy Hash: 7631E4B1900259FFCB00DFA8CDA8ADE3BB6EB05314F004225F921AB2D1C3709945CB90
                                                                                    Function 006E5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(?,00001053,000000FF,?), ref: 006E5745
                                                                                    • SendMessageW.USER32(?,00001074,?,00000001), ref: 006E579D
                                                                                    • _wcslen.LIBCMT ref: 006E57AF
                                                                                    • _wcslen.LIBCMT ref: 006E57BA
                                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 006E5816
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$_wcslen
                                                                                    • String ID:
                                                                                    • API String ID: 763830540-0
                                                                                    • Opcode ID: 1b750332caf81c074e33e093b53e2d9064ca5353a472bd39b62f82f9c9d732d5
                                                                                    • Instruction ID: 432c6330ca1b051923797d72c010f9ccf157722518264dab1e6cb2bf6579b05b
                                                                                    • Opcode Fuzzy Hash: 1b750332caf81c074e33e093b53e2d9064ca5353a472bd39b62f82f9c9d732d5
                                                                                    • Instruction Fuzzy Hash: D3218771905798DADF209F61CC85AEE77BAFF14728F108116E92ADB2C1D7708986CF50
                                                                                    Function 006D0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsWindow.USER32(00000000), ref: 006D0951
                                                                                    • GetForegroundWindow.USER32 ref: 006D0968
                                                                                    • GetDC.USER32(00000000), ref: 006D09A4
                                                                                    • GetPixel.GDI32(00000000,?,00000003), ref: 006D09B0
                                                                                    • ReleaseDC.USER32(00000000,00000003), ref: 006D09E8
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$ForegroundPixelRelease
                                                                                    • String ID:
                                                                                    • API String ID: 4156661090-0
                                                                                    • Opcode ID: 6e01b3daabdca55263f0c1b9137f652e0bc6f7c22b470782b7979f3fc550aead
                                                                                    • Instruction ID: 725a7cfb0a58b7dff29e047f2de2ecf7a4116c71baa41bf88e0547f39598fbd0
                                                                                    • Opcode Fuzzy Hash: 6e01b3daabdca55263f0c1b9137f652e0bc6f7c22b470782b7979f3fc550aead
                                                                                    • Instruction Fuzzy Hash: 5E218435A00204AFD744EF65C894AAEB7F6EF49711F04846DE856DB352DB30AC05CB90
                                                                                    Function 0068CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetEnvironmentStringsW.KERNEL32 ref: 0068CDC6
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0068CDE9
                                                                                      • Part of subcall function 00683820: RtlAllocateHeap.NTDLL(00000000,?,00721444,?,0066FDF5,?,?,0065A976,00000010,00721440,006513FC,?,006513C6,?,00651129), ref: 00683852
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0068CE0F
                                                                                    • _free.LIBCMT ref: 0068CE22
                                                                                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0068CE31
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                    • String ID:
                                                                                    • API String ID: 336800556-0
                                                                                    • Opcode ID: 867dbe97ebb25f4af242fe87aca2da412c8ccdfc5fa65bda993aea702154bc77
                                                                                    • Instruction ID: 0aa419bd996ebae6577d7310cbd762dc21606226c8e3a7b50a425a0b754871dc
                                                                                    • Opcode Fuzzy Hash: 867dbe97ebb25f4af242fe87aca2da412c8ccdfc5fa65bda993aea702154bc77
                                                                                    • Instruction Fuzzy Hash: 660184726012567FA72136BA6C9CDBB696FDFCABB1315432DF905C7201EA718D0283B4
                                                                                    Function 00669639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00669693
                                                                                    • SelectObject.GDI32(?,00000000), ref: 006696A2
                                                                                    • BeginPath.GDI32(?), ref: 006696B9
                                                                                    • SelectObject.GDI32(?,00000000), ref: 006696E2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ObjectSelect$BeginCreatePath
                                                                                    • String ID:
                                                                                    • API String ID: 3225163088-0
                                                                                    • Opcode ID: 6a6f6c32d0d29a239e564ae52fc97c22b6e468b34d980e91076eeab14aba3879
                                                                                    • Instruction ID: c354f3274f8e3192646235608b34e075c3a0dbbf5839bad27f4254dc440163e7
                                                                                    • Opcode Fuzzy Hash: 6a6f6c32d0d29a239e564ae52fc97c22b6e468b34d980e91076eeab14aba3879
                                                                                    • Instruction Fuzzy Hash: D8218370801385EBEF219F24DC547E93B6ABB21325F508219F850D61B1D3746893CFA8
                                                                                    Function 006B5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _memcmp
                                                                                    • String ID:
                                                                                    • API String ID: 2931989736-0
                                                                                    • Opcode ID: 8956af5f32813242e81df1976a414a3a4e3c195b40b9f95f3f8c2ebdc72599c4
                                                                                    • Instruction ID: 7e707d69f69945e6fad05f38082924a9c5fd1f7bb1deb475f8a9fb409445d4f5
                                                                                    • Opcode Fuzzy Hash: 8956af5f32813242e81df1976a414a3a4e3c195b40b9f95f3f8c2ebdc72599c4
                                                                                    • Instruction Fuzzy Hash: 0301D6F1341705BBA21852159D42FFB735F9B217A8B204035FD0A9E241FE20EE5283A4
                                                                                    Function 00682DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(?,?,?,0067F2DE,00683863,00721444,?,0066FDF5,?,?,0065A976,00000010,00721440,006513FC,?,006513C6), ref: 00682DFD
                                                                                    • _free.LIBCMT ref: 00682E32
                                                                                    • _free.LIBCMT ref: 00682E59
                                                                                    • SetLastError.KERNEL32(00000000,00651129), ref: 00682E66
                                                                                    • SetLastError.KERNEL32(00000000,00651129), ref: 00682E6F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_free
                                                                                    • String ID:
                                                                                    • API String ID: 3170660625-0
                                                                                    • Opcode ID: 8348ec88c33ab5d5f18f9df3036690a2ae5c3f221ca7e92f73d0a4c1776c99e7
                                                                                    • Instruction ID: b0a0f4628fc2d3a2a1205692f841f6ae059d289b93f9a2c8259811ecb7b49521
                                                                                    • Opcode Fuzzy Hash: 8348ec88c33ab5d5f18f9df3036690a2ae5c3f221ca7e92f73d0a4c1776c99e7
                                                                                    • Instruction Fuzzy Hash: 2001F97224560277CB1237796CADD6B156FABC1775B21432CF521923D2EF248C025328
                                                                                    Function 006B000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?,?,?,006B035E), ref: 006B002B
                                                                                    • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?,?), ref: 006B0046
                                                                                    • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?,?), ref: 006B0054
                                                                                    • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?), ref: 006B0064
                                                                                    • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006AFF41,80070057,?,?), ref: 006B0070
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                                    • String ID:
                                                                                    • API String ID: 3897988419-0
                                                                                    • Opcode ID: d08f8720f565af72bf0c0668f65d1db14984bb499c8abaaaf3c85f8db0670769
                                                                                    • Instruction ID: d1ff4285e14b91e9d3a50f3960d07f2efb345f3ca4c334dfeeb9c427f3a45a92
                                                                                    • Opcode Fuzzy Hash: d08f8720f565af72bf0c0668f65d1db14984bb499c8abaaaf3c85f8db0670769
                                                                                    • Instruction Fuzzy Hash: 4A018FB2600304BFEB115F68DC44BEB7EAFEB447A1F145124F905D6210D771DD818BA0
                                                                                    Function 006BE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • QueryPerformanceCounter.KERNEL32(?), ref: 006BE997
                                                                                    • QueryPerformanceFrequency.KERNEL32(?), ref: 006BE9A5
                                                                                    • Sleep.KERNEL32(00000000), ref: 006BE9AD
                                                                                    • QueryPerformanceCounter.KERNEL32(?), ref: 006BE9B7
                                                                                    • Sleep.KERNEL32 ref: 006BE9F3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                    • String ID:
                                                                                    • API String ID: 2833360925-0
                                                                                    • Opcode ID: 4ee43da02a13216dd6e9b268c1b26f466f9c238c7f3bbbacc303fcb0af017c84
                                                                                    • Instruction ID: 29ec19404a1f85c441f6d1a5af1196f518c93114d929f147a2daff24d7716293
                                                                                    • Opcode Fuzzy Hash: 4ee43da02a13216dd6e9b268c1b26f466f9c238c7f3bbbacc303fcb0af017c84
                                                                                    • Instruction Fuzzy Hash: 9C019E71C0162DDBCF00AFE5DC99AEDBB7AFF09311F004546E502B2240CB35A69ACBA1
                                                                                    Function 006B10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006B1114
                                                                                    • GetLastError.KERNEL32(?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B1120
                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B112F
                                                                                    • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,006B0B9B,?,?,?), ref: 006B1136
                                                                                    • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006B114D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                                    • String ID:
                                                                                    • API String ID: 842720411-0
                                                                                    • Opcode ID: 4ff30d86d61f4fdef89a299c6c1d6e99e0ae323c5515841e31edbb3d3720eabb
                                                                                    • Instruction ID: a6f76e8dd05c0aba295c273e26b7722b5fafc735716c51d93d3a60dd9ab8a8e6
                                                                                    • Opcode Fuzzy Hash: 4ff30d86d61f4fdef89a299c6c1d6e99e0ae323c5515841e31edbb3d3720eabb
                                                                                    • Instruction Fuzzy Hash: A6011D75100305BFDB114F69DC99AAA3B6FEF86360B504419FA45DB350DA31DC419B60
                                                                                    Function 006B0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006B0FCA
                                                                                    • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006B0FD6
                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006B0FE5
                                                                                    • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006B0FEC
                                                                                    • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006B1002
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                    • String ID:
                                                                                    • API String ID: 44706859-0
                                                                                    • Opcode ID: c8559ac85a7ae2be75a36c77b60537cebdf9dd709f7e181184aefb11d392685c
                                                                                    • Instruction ID: 1ed42df352cc8a95d1b8d6bb4ba3788262aef3aa132c80b846de30ebaa4ebd44
                                                                                    • Opcode Fuzzy Hash: c8559ac85a7ae2be75a36c77b60537cebdf9dd709f7e181184aefb11d392685c
                                                                                    • Instruction Fuzzy Hash: 0EF0A975200345BBDB211FA4DC8DF963BAEEF8A772F500414FE05CA290CA31DC818B60
                                                                                    Function 006B1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006B102A
                                                                                    • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006B1036
                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006B1045
                                                                                    • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006B104C
                                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006B1062
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                    • String ID:
                                                                                    • API String ID: 44706859-0
                                                                                    • Opcode ID: 95d141445e27ce4f72995ab612e6b8f978dd636092be6961f0070493ad4114b3
                                                                                    • Instruction ID: 135510a07ec6bc9cc393f4a29dd68ec93c871e63990a26fe29e3009dabfce802
                                                                                    • Opcode Fuzzy Hash: 95d141445e27ce4f72995ab612e6b8f978dd636092be6961f0070493ad4114b3
                                                                                    • Instruction Fuzzy Hash: 1AF04975200345BBDB216FA4EC99F963BAEEF8A771F500414FE45CA290CA71D8819A60
                                                                                    Function 006C030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,006C017D,?,006C32FC,?,00000001,00692592,?), ref: 006C0324
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,006C017D,?,006C32FC,?,00000001,00692592,?), ref: 006C0331
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,006C017D,?,006C32FC,?,00000001,00692592,?), ref: 006C033E
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,006C017D,?,006C32FC,?,00000001,00692592,?), ref: 006C034B
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,006C017D,?,006C32FC,?,00000001,00692592,?), ref: 006C0358
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,006C017D,?,006C32FC,?,00000001,00692592,?), ref: 006C0365
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CloseHandle
                                                                                    • String ID:
                                                                                    • API String ID: 2962429428-0
                                                                                    • Opcode ID: 9a2b4d1796b04a8c4a4225644b77e649938848fa0407c1abd64fddada49a0655
                                                                                    • Instruction ID: 1dca13222c0c333bd13a3ffa44974673652e12b7c6f92922257a48712838c1b1
                                                                                    • Opcode Fuzzy Hash: 9a2b4d1796b04a8c4a4225644b77e649938848fa0407c1abd64fddada49a0655
                                                                                    • Instruction Fuzzy Hash: AD019076800B56DFDB309F66D880962FBFAFE502153158A3ED19A52A31C371A955CE80
                                                                                    Function 0068D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 0068D752
                                                                                      • Part of subcall function 006829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000), ref: 006829DE
                                                                                      • Part of subcall function 006829C8: GetLastError.KERNEL32(00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000,00000000), ref: 006829F0
                                                                                    • _free.LIBCMT ref: 0068D764
                                                                                    • _free.LIBCMT ref: 0068D776
                                                                                    • _free.LIBCMT ref: 0068D788
                                                                                    • _free.LIBCMT ref: 0068D79A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: 86f58a1fe9426fe02ad2984e6ed8ff06b495ffcab2d3814d561d249c66fdbc83
                                                                                    • Instruction ID: ce06dd4d45e2b0b773824925f2ecf3ee45562b81dce0220cfc7eff7896056de3
                                                                                    • Opcode Fuzzy Hash: 86f58a1fe9426fe02ad2984e6ed8ff06b495ffcab2d3814d561d249c66fdbc83
                                                                                    • Instruction Fuzzy Hash: CEF018325442056B8651FB59F9C5C9677EFBB447107954909F044E7681C738FC404778
                                                                                    Function 006B5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 006B5C58
                                                                                    • GetWindowTextW.USER32(00000000,?,00000100), ref: 006B5C6F
                                                                                    • MessageBeep.USER32(00000000), ref: 006B5C87
                                                                                    • KillTimer.USER32(?,0000040A), ref: 006B5CA3
                                                                                    • EndDialog.USER32(?,00000001), ref: 006B5CBD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                    • String ID:
                                                                                    • API String ID: 3741023627-0
                                                                                    • Opcode ID: 54cbda8494f288b3bc2137b453536c04c46bbd3eb73c3f3d1339ad64ce91f909
                                                                                    • Instruction ID: a06870e598f8ec54288e28da27d7f453249238c0a5367a000b5a45b7a4b2bf39
                                                                                    • Opcode Fuzzy Hash: 54cbda8494f288b3bc2137b453536c04c46bbd3eb73c3f3d1339ad64ce91f909
                                                                                    • Instruction Fuzzy Hash: F4018170500B44ABEB205B14DD8EFE67BBBBB00B05F00155DB583A50E1DBF0A989CB91
                                                                                    Function 006822A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 006822BE
                                                                                      • Part of subcall function 006829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000), ref: 006829DE
                                                                                      • Part of subcall function 006829C8: GetLastError.KERNEL32(00000000,?,0068D7D1,00000000,00000000,00000000,00000000,?,0068D7F8,00000000,00000007,00000000,?,0068DBF5,00000000,00000000), ref: 006829F0
                                                                                    • _free.LIBCMT ref: 006822D0
                                                                                    • _free.LIBCMT ref: 006822E3
                                                                                    • _free.LIBCMT ref: 006822F4
                                                                                    • _free.LIBCMT ref: 00682305
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: f598a416fe52376b72ef8dc0af06ecba9a39fb68b3b4d524fc53a3d142b7fd07
                                                                                    • Instruction ID: 83fd139b0b8b792cc4a91425b838943417bdbdc8c97ba2b5b816fe9bb79f4fa8
                                                                                    • Opcode Fuzzy Hash: f598a416fe52376b72ef8dc0af06ecba9a39fb68b3b4d524fc53a3d142b7fd07
                                                                                    • Instruction Fuzzy Hash: 32F030705801518B8B63BF99BC518883BA6B728B50741C60AF410D22B2C73C15539BEC
                                                                                    Function 006695C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • EndPath.GDI32(?), ref: 006695D4
                                                                                    • StrokeAndFillPath.GDI32(?,?,006A71F7,00000000,?,?,?), ref: 006695F0
                                                                                    • SelectObject.GDI32(?,00000000), ref: 00669603
                                                                                    • DeleteObject.GDI32 ref: 00669616
                                                                                    • StrokePath.GDI32(?), ref: 00669631
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                    • String ID:
                                                                                    • API String ID: 2625713937-0
                                                                                    • Opcode ID: dc6d200f63397cd9c1ae1c17b3e287434ea55758d335c9707e50917c15486c38
                                                                                    • Instruction ID: 35ebae2cb1f1a3bcf17aa8ded6e9986039f1773814f7fe3ecc58c8f1fa6814a2
                                                                                    • Opcode Fuzzy Hash: dc6d200f63397cd9c1ae1c17b3e287434ea55758d335c9707e50917c15486c38
                                                                                    • Instruction Fuzzy Hash: E1F019300053C8EBDB265F65ED58BA43B66BB51336F448218F8A5991F0C7399993DF28
                                                                                    Function 00680F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: __freea$_free
                                                                                    • String ID: a/p$am/pm
                                                                                    • API String ID: 3432400110-3206640213
                                                                                    • Opcode ID: a8d0b474e84541972ac8b3c3110198d356020ae9c80bed2c0fb3fe241687ab88
                                                                                    • Instruction ID: ad5acc9b0f28f59f6854e0038d91bc4d6a54a253e3a15c7da52fe6b21f3933f3
                                                                                    • Opcode Fuzzy Hash: a8d0b474e84541972ac8b3c3110198d356020ae9c80bed2c0fb3fe241687ab88
                                                                                    • Instruction Fuzzy Hash: C1D1E031900206CBDB24AF68C859AFAB7BAEF07700F24435AE9459F750D7759E83CB91
                                                                                    Function 006D61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00670242: EnterCriticalSection.KERNEL32(0072070C,00721884,?,?,0066198B,00722518,?,?,?,006512F9,00000000), ref: 0067024D
                                                                                      • Part of subcall function 00670242: LeaveCriticalSection.KERNEL32(0072070C,?,0066198B,00722518,?,?,?,006512F9,00000000), ref: 0067028A
                                                                                      • Part of subcall function 006700A3: __onexit.LIBCMT ref: 006700A9
                                                                                    • __Init_thread_footer.LIBCMT ref: 006D6238
                                                                                      • Part of subcall function 006701F8: EnterCriticalSection.KERNEL32(0072070C,?,?,00668747,00722514), ref: 00670202
                                                                                      • Part of subcall function 006701F8: LeaveCriticalSection.KERNEL32(0072070C,?,00668747,00722514), ref: 00670235
                                                                                      • Part of subcall function 006C359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006C35E4
                                                                                      • Part of subcall function 006C359C: LoadStringW.USER32(00722390,?,00000FFF,?), ref: 006C360A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
                                                                                    • String ID: x#r$x#r$x#r
                                                                                    • API String ID: 1072379062-2161639933
                                                                                    • Opcode ID: 6c6762b2f7e4b16b971e38bb1e9960621eaef327d47d5128962602622e848bca
                                                                                    • Instruction ID: 06ad3e0889715d15b691f6ae3a8244991abcba6a27812961fd65d2e2872fdc09
                                                                                    • Opcode Fuzzy Hash: 6c6762b2f7e4b16b971e38bb1e9960621eaef327d47d5128962602622e848bca
                                                                                    • Instruction Fuzzy Hash: 57C16B71A00105AFCB24DF98D891EBAB7BAEF48310F14806EF9059B391DB75EE45CB94
                                                                                    Function 00685AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: JOe
                                                                                    • API String ID: 0-3363116825
                                                                                    • Opcode ID: ddf2f1a9e083bc1839c8c9ee76958112556efd9d69f2a4c412275228236bda8f
                                                                                    • Instruction ID: e8ef6f272a6b7b0d9d00f1edd31f41d5a408005c6fc68c5e29d47675ca08c604
                                                                                    • Opcode Fuzzy Hash: ddf2f1a9e083bc1839c8c9ee76958112556efd9d69f2a4c412275228236bda8f
                                                                                    • Instruction Fuzzy Hash: C151C075D006099FCF21BFA8C845FEEBBBAAF15310F14425EF406A7292D7319A02CB65
                                                                                    Function 00688A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00688B6E
                                                                                    • GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00688B7A
                                                                                    • __dosmaperr.LIBCMT ref: 00688B81
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharErrorLastMultiWide__dosmaperr
                                                                                    • String ID: .g
                                                                                    • API String ID: 2434981716-2054203957
                                                                                    • Opcode ID: 0b7776b2788b952aaf005eadbcfdb725599679bb84aa6b6a4c56cf9f751329e1
                                                                                    • Instruction ID: 47c754e065024c4829b329f52d94e5c22c41c9a0c8e53df7cfcdf44ddf3a0d34
                                                                                    • Opcode Fuzzy Hash: 0b7776b2788b952aaf005eadbcfdb725599679bb84aa6b6a4c56cf9f751329e1
                                                                                    • Instruction Fuzzy Hash: A7416C70604185AFDB34AF68C880ABD7FA7DFC5304B2883A9F89597643DE358C039794
                                                                                    Function 006B2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006BB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006B21D0,?,?,00000034,00000800,?,00000034), ref: 006BB42D
                                                                                    • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 006B2760
                                                                                      • Part of subcall function 006BB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006B21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 006BB3F8
                                                                                      • Part of subcall function 006BB32A: GetWindowThreadProcessId.USER32(?,?), ref: 006BB355
                                                                                      • Part of subcall function 006BB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,006B2194,00000034,?,?,00001004,00000000,00000000), ref: 006BB365
                                                                                      • Part of subcall function 006BB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,006B2194,00000034,?,?,00001004,00000000,00000000), ref: 006BB37B
                                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006B27CD
                                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006B281A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                                    • String ID: @
                                                                                    • API String ID: 4150878124-2766056989
                                                                                    • Opcode ID: 1a0bd6159204ab82c21aeb3df1a0214c663830664e942cbe7d626eedec2b2df0
                                                                                    • Instruction ID: b4f07f0570cd2744892efe21278ee5ab0566f9ade413384e5fa16e7113924919
                                                                                    • Opcode Fuzzy Hash: 1a0bd6159204ab82c21aeb3df1a0214c663830664e942cbe7d626eedec2b2df0
                                                                                    • Instruction Fuzzy Hash: 88414FB2900218AFDB10DFA4CD95BDEBBB9EF05700F005059FA55B7181DB706E85CBA4
                                                                                    Function 0068172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00681769
                                                                                    • _free.LIBCMT ref: 00681834
                                                                                    • _free.LIBCMT ref: 0068183E
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free$FileModuleName
                                                                                    • String ID: C:\Users\user\Desktop\file.exe
                                                                                    • API String ID: 2506810119-1957095476
                                                                                    • Opcode ID: 07709022f215c811f041c11f2efde1d6bf5b3502653a8fe2982a20c506dbe54a
                                                                                    • Instruction ID: d395b626011484e0e30bb092a4307cd0635ec4b260afa75d11fd8bfc7ddeb33c
                                                                                    • Opcode Fuzzy Hash: 07709022f215c811f041c11f2efde1d6bf5b3502653a8fe2982a20c506dbe54a
                                                                                    • Instruction Fuzzy Hash: D43182B1A00218EBDB21EB999885DDEBBFEFB96710B50426AF4049B311D6704E42CB94
                                                                                    Function 006BC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 006BC306
                                                                                    • DeleteMenu.USER32(?,00000007,00000000), ref: 006BC34C
                                                                                    • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00721990,01905440), ref: 006BC395
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Menu$Delete$InfoItem
                                                                                    • String ID: 0
                                                                                    • API String ID: 135850232-4108050209
                                                                                    • Opcode ID: 7e86ef4f75e68699849d4c51efd0da7d4fb09de2f0c34a570a00dbffe3b2d71a
                                                                                    • Instruction ID: 20b89518908e2ddb8cb4fdd27d30d2c44268a0f3fe55ca3e32bd63e162618342
                                                                                    • Opcode Fuzzy Hash: 7e86ef4f75e68699849d4c51efd0da7d4fb09de2f0c34a570a00dbffe3b2d71a
                                                                                    • Instruction Fuzzy Hash: 4141A0B12043419FD720DF24D884F9ABBE6AF85320F04861EF8A5973D1D770AA45CB66
                                                                                    Function 006E4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,006ECC08,00000000,?,?,?,?), ref: 006E44AA
                                                                                    • GetWindowLongW.USER32 ref: 006E44C7
                                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 006E44D7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Long
                                                                                    • String ID: SysTreeView32
                                                                                    • API String ID: 847901565-1698111956
                                                                                    • Opcode ID: 942d4854067cf3951a66a37594264bd34da2a05a9774189a5b37a558ac6d04d7
                                                                                    • Instruction ID: 40939d95ea2985762d5431cba6575cca3451066071988e74875b967f2b5bd099
                                                                                    • Opcode Fuzzy Hash: 942d4854067cf3951a66a37594264bd34da2a05a9774189a5b37a558ac6d04d7
                                                                                    • Instruction Fuzzy Hash: A0319C31211385AFDB208E39DC45BEA77AAEB08334F204319F975932D0DB74AC519B50
                                                                                    Function 006B6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SysReAllocString.OLEAUT32(?,?), ref: 006B6EED
                                                                                    • VariantCopyInd.OLEAUT32(?,?), ref: 006B6F08
                                                                                    • VariantClear.OLEAUT32(?), ref: 006B6F12
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Variant$AllocClearCopyString
                                                                                    • String ID: *jk
                                                                                    • API String ID: 2173805711-2414420441
                                                                                    • Opcode ID: 7f0eefa97400d3d5d551020a5062167f526b7b63f26736bf5fafdebc4a3d1fa0
                                                                                    • Instruction ID: 2b658c6618114e7511acfc13e9cd1a4d5ef93c9ee29b9be5a696089185a453a0
                                                                                    • Opcode Fuzzy Hash: 7f0eefa97400d3d5d551020a5062167f526b7b63f26736bf5fafdebc4a3d1fa0
                                                                                    • Instruction Fuzzy Hash: 33316FB1604245DBCB05AFA5E8919FE77BBFF85301F1004A8F9024B2B1DB389956DB94
                                                                                    Function 006D304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006D335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,006D3077,?,?), ref: 006D3378
                                                                                    • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 006D307A
                                                                                    • _wcslen.LIBCMT ref: 006D309B
                                                                                    • htons.WSOCK32(00000000,?,?,00000000), ref: 006D3106
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                                                    • String ID: 255.255.255.255
                                                                                    • API String ID: 946324512-2422070025
                                                                                    • Opcode ID: 0be5af70f5852dde7e89444fd140d79810b2f67fde4ce3f1f6d36d31ca592918
                                                                                    • Instruction ID: b7355b909f9d1c7b6b900f239d0b41702866b11a31d35b27e2343899d0d5914f
                                                                                    • Opcode Fuzzy Hash: 0be5af70f5852dde7e89444fd140d79810b2f67fde4ce3f1f6d36d31ca592918
                                                                                    • Instruction Fuzzy Hash: 4631C439A002129FC720CF68C985EAA77E2EF54318F24805AE9158B392DB71DE46C762
                                                                                    Function 006E3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 006E3F40
                                                                                    • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 006E3F54
                                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 006E3F78
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$Window
                                                                                    • String ID: SysMonthCal32
                                                                                    • API String ID: 2326795674-1439706946
                                                                                    • Opcode ID: 8356a94188e87fce3493b1104f3814c44ccafa31f0748fb0c29b0d063f1a1872
                                                                                    • Instruction ID: 4b0130d3fa4bce49341e74ca84b459378a46a1735f75f65529c85c751da69950
                                                                                    • Opcode Fuzzy Hash: 8356a94188e87fce3493b1104f3814c44ccafa31f0748fb0c29b0d063f1a1872
                                                                                    • Instruction Fuzzy Hash: A521AD32600269BBDF218F91CC86FEA3B76EF48724F110214FA156B2D0D6B5A951CB90
                                                                                    Function 006E4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 006E4705
                                                                                    • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 006E4713
                                                                                    • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 006E471A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$DestroyWindow
                                                                                    • String ID: msctls_updown32
                                                                                    • API String ID: 4014797782-2298589950
                                                                                    • Opcode ID: 579e71da76bbe8b92194502c7d838ca210f5d345e4d905c41acbc06a562ee33d
                                                                                    • Instruction ID: 1394f6f1866d6437e957962e710c27164e661822a56557212a809ddf4caf10fc
                                                                                    • Opcode Fuzzy Hash: 579e71da76bbe8b92194502c7d838ca210f5d345e4d905c41acbc06a562ee33d
                                                                                    • Instruction Fuzzy Hash: 7F2160B5601249AFDB10DF65DCD1DA737AEEF5A3A4B440059FA009B391CB30EC52CAA4
                                                                                    Function 006B95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen
                                                                                    • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                    • API String ID: 176396367-2734436370
                                                                                    • Opcode ID: 1cdb9a731d885352d78be89d3a55ab15f815edbe2cf4f86b2b0def175a9bd095
                                                                                    • Instruction ID: 1237a96546864692636c4a5c4f600756c49f66ab151594e49cee2cc45ef442d9
                                                                                    • Opcode Fuzzy Hash: 1cdb9a731d885352d78be89d3a55ab15f815edbe2cf4f86b2b0def175a9bd095
                                                                                    • Instruction Fuzzy Hash: 092138B214421066D331AB25AC06FFB739B9F51300F10802AFB4997242FB519DC6C3B9
                                                                                    Function 006E37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 006E3840
                                                                                    • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 006E3850
                                                                                    • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 006E3876
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend$MoveWindow
                                                                                    • String ID: Listbox
                                                                                    • API String ID: 3315199576-2633736733
                                                                                    • Opcode ID: 024a8f17e4f14f60d3b951453e50e7799465d0ba2893cf88216d8c2b7dcb3202
                                                                                    • Instruction ID: 5f690a6f58847aa96ae6e5391f1e8762af1dd66330a1ba3b2db9bff3eb8a92df
                                                                                    • Opcode Fuzzy Hash: 024a8f17e4f14f60d3b951453e50e7799465d0ba2893cf88216d8c2b7dcb3202
                                                                                    • Instruction Fuzzy Hash: F7218072611268BBEF218F56CC85EEB376BEF89760F108124F9059B290C675DC52C7A0
                                                                                    Function 006C49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 006C4A08
                                                                                    • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 006C4A5C
                                                                                    • SetErrorMode.KERNEL32(00000000,?,?,006ECC08), ref: 006C4AD0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorMode$InformationVolume
                                                                                    • String ID: %lu
                                                                                    • API String ID: 2507767853-685833217
                                                                                    • Opcode ID: e6169ee8ced887aff7dc8ee9d3cf95ce9886d5699bbeb600790c92bdd7010e14
                                                                                    • Instruction ID: d90c0e9df50064d728583e6721acbdc8c1082ed309b00a85c0e1c1ff752acc80
                                                                                    • Opcode Fuzzy Hash: e6169ee8ced887aff7dc8ee9d3cf95ce9886d5699bbeb600790c92bdd7010e14
                                                                                    • Instruction Fuzzy Hash: 30315071A00209AFDB50DF54C885EAA77F9EF05314F1480A9F905DF252DB71ED46CB61
                                                                                    Function 006E41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 006E424F
                                                                                    • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 006E4264
                                                                                    • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 006E4271
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend
                                                                                    • String ID: msctls_trackbar32
                                                                                    • API String ID: 3850602802-1010561917
                                                                                    • Opcode ID: bdee7928db72b335f66d9db07f18317f7317aac55f87cf365816051976621cf6
                                                                                    • Instruction ID: 49120f2e9e8b8de048d24ecbbcb2a4b9934c4ef350eb5239d38238df35ea0eb2
                                                                                    • Opcode Fuzzy Hash: bdee7928db72b335f66d9db07f18317f7317aac55f87cf365816051976621cf6
                                                                                    • Instruction Fuzzy Hash: 7C11C131240388BEEF205F39CC46FEB3BA9EF95B64F110124FA55E6190D671D8529B14
                                                                                    Function 006B2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                      • Part of subcall function 006B2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 006B2DC5
                                                                                      • Part of subcall function 006B2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 006B2DD6
                                                                                      • Part of subcall function 006B2DA7: GetCurrentThreadId.KERNEL32 ref: 006B2DDD
                                                                                      • Part of subcall function 006B2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 006B2DE4
                                                                                    • GetFocus.USER32 ref: 006B2F78
                                                                                      • Part of subcall function 006B2DEE: GetParent.USER32(00000000), ref: 006B2DF9
                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 006B2FC3
                                                                                    • EnumChildWindows.USER32(?,006B303B), ref: 006B2FEB
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                                                    • String ID: %s%d
                                                                                    • API String ID: 1272988791-1110647743
                                                                                    • Opcode ID: 657e867b12f0e5bdf5b2e5240851967fd9209c54d3b794a39a97b755116ee1fb
                                                                                    • Instruction ID: d8885b7d59c0a563d0b98e2826ac343b52b97e87eae69ccd3ed82030cde7462b
                                                                                    • Opcode Fuzzy Hash: 657e867b12f0e5bdf5b2e5240851967fd9209c54d3b794a39a97b755116ee1fb
                                                                                    • Instruction Fuzzy Hash: 8811C0B13002056BCF547F60CCD5EEE37ABAF94314F044079FD099B292EE30998A8B60
                                                                                    Function 006E5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 006E58C1
                                                                                    • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 006E58EE
                                                                                    • DrawMenuBar.USER32(?), ref: 006E58FD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Menu$InfoItem$Draw
                                                                                    • String ID: 0
                                                                                    • API String ID: 3227129158-4108050209
                                                                                    • Opcode ID: e086dbd9d2f9b643144772eb4bc1af91b0a12208b5216afaeb8787b3ef262eb1
                                                                                    • Instruction ID: ce05c417952b4ecf26e2b2c5d5dd19b6ba20f9ccb26ee3a3c71aaedbfbb23abd
                                                                                    • Opcode Fuzzy Hash: e086dbd9d2f9b643144772eb4bc1af91b0a12208b5216afaeb8787b3ef262eb1
                                                                                    • Instruction Fuzzy Hash: D001A131500388EFDB109F12DC44BEEBBB6FB45364F00809AE849DA251DB308A91DF20
                                                                                    Function 006AD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 006AD3BF
                                                                                    • FreeLibrary.KERNEL32 ref: 006AD3E5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: AddressFreeLibraryProc
                                                                                    • String ID: GetSystemWow64DirectoryW$X64
                                                                                    • API String ID: 3013587201-2590602151
                                                                                    • Opcode ID: 230339fdfe4f9214c50d6dc6695781c5ea1031c930daba30989f09f14c14cd73
                                                                                    • Instruction ID: d0b1b7e3dc899769ce2aa045ce770969da81f3ef664e1c1a6aa6d64a36427b74
                                                                                    • Opcode Fuzzy Hash: 230339fdfe4f9214c50d6dc6695781c5ea1031c930daba30989f09f14c14cd73
                                                                                    • Instruction Fuzzy Hash: CDF055318027219BCB317B104C54AE93723BF13701B548118E903E5A08DB20CE4ACE82
                                                                                    Function 006B007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 71dfd7b1a01d689efabf9681d4888fed46b2980f987ffead9ebba6723300c927
                                                                                    • Instruction ID: 99dfb652a8d12a35290e19a48d05f7c70b9c683c3e50b8ed7c5fd3e8313c6413
                                                                                    • Opcode Fuzzy Hash: 71dfd7b1a01d689efabf9681d4888fed46b2980f987ffead9ebba6723300c927
                                                                                    • Instruction Fuzzy Hash: 64C12FB5A00216EFDB14CF98C898AEEBBB6FF48714F148598E505DB251D731DE82CB90
                                                                                    Function 006D342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Variant$ClearInitInitializeUninitialize
                                                                                    • String ID:
                                                                                    • API String ID: 1998397398-0
                                                                                    • Opcode ID: 400188dab51ac7df487b271b5c6299acfc827645f327b1a2f7b177843351abdb
                                                                                    • Instruction ID: 7233c99513db0893545048380c26d643b164f85b4f255847073fabf36bea7875
                                                                                    • Opcode Fuzzy Hash: 400188dab51ac7df487b271b5c6299acfc827645f327b1a2f7b177843351abdb
                                                                                    • Instruction Fuzzy Hash: 92A14A756043109FC740DF28D485A6AB7E6FF88715F04885EF98A9B362DB30EE05CB96
                                                                                    Function 006B0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,006EFC08,?), ref: 006B05F0
                                                                                    • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,006EFC08,?), ref: 006B0608
                                                                                    • CLSIDFromProgID.OLE32(?,?,00000000,006ECC40,000000FF,?,00000000,00000800,00000000,?,006EFC08,?), ref: 006B062D
                                                                                    • _memcmp.LIBVCRUNTIME ref: 006B064E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FromProg$FreeTask_memcmp
                                                                                    • String ID:
                                                                                    • API String ID: 314563124-0
                                                                                    • Opcode ID: 943610cc26024e6f79e6041a24237166e157d63385f74add4232a29bb4d4319d
                                                                                    • Instruction ID: 2228f9080d2735fcb5494b212c43903b5061847005b313ebaecd068e387211de
                                                                                    • Opcode Fuzzy Hash: 943610cc26024e6f79e6041a24237166e157d63385f74add4232a29bb4d4319d
                                                                                    • Instruction Fuzzy Hash: B88110B1900109EFDB14DF94C984DEEBBBAFF89315F204558F506AB250DB71AE46CB60
                                                                                    Function 006DA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 006DA6AC
                                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 006DA6BA
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • Process32NextW.KERNEL32(00000000,?), ref: 006DA79C
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 006DA7AB
                                                                                      • Part of subcall function 0066CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00693303,?), ref: 0066CE8A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                                                    • String ID:
                                                                                    • API String ID: 1991900642-0
                                                                                    • Opcode ID: a4fb834d5a560a55c686b06fe505976cf8f4357d337cd479127ea41ecf54dc5d
                                                                                    • Instruction ID: f59329998ebc5bfabdfabf0ca594e941a6d7eed7a0280a705dc3e42901c29b9a
                                                                                    • Opcode Fuzzy Hash: a4fb834d5a560a55c686b06fe505976cf8f4357d337cd479127ea41ecf54dc5d
                                                                                    • Instruction Fuzzy Hash: 56516F71508300AFD750EF24C886A6BBBE9FF89754F40492DF98597252EB30D908CB96
                                                                                    Function 00691391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 024e88f3b3a0a8b4829e520617c439fb9c636c0a00fdd31d671ce3b5292efb67
                                                                                    • Instruction ID: e2f4dd044911e96d57fb4250412105989e5abb58b1947a3ba6eae6c489b163aa
                                                                                    • Opcode Fuzzy Hash: 024e88f3b3a0a8b4829e520617c439fb9c636c0a00fdd31d671ce3b5292efb67
                                                                                    • Instruction Fuzzy Hash: D4412C316001025BDF217BF98C45AFE3AEFEF4BB70F344229F429DA692E63489415766
                                                                                    Function 006E6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetWindowRect.USER32(?,?), ref: 006E62E2
                                                                                    • ScreenToClient.USER32(?,?), ref: 006E6315
                                                                                    • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 006E6382
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$ClientMoveRectScreen
                                                                                    • String ID:
                                                                                    • API String ID: 3880355969-0
                                                                                    • Opcode ID: 609dc6f2eca25e3b2fc6da7f82470ee9f23ce2a9c07de6150a5cf03b4a3138d7
                                                                                    • Instruction ID: faa2b0962ff2df28286475a4a0753bd6d2b85f99ffd557db106cb7b718ddbee4
                                                                                    • Opcode Fuzzy Hash: 609dc6f2eca25e3b2fc6da7f82470ee9f23ce2a9c07de6150a5cf03b4a3138d7
                                                                                    • Instruction Fuzzy Hash: 3E510974901289EFCF20DF65D8849EE7BB6FF653A0F208159F9559B290D730AD81CB50
                                                                                    Function 006D1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • socket.WSOCK32(00000002,00000002,00000011), ref: 006D1AFD
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D1B0B
                                                                                    • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 006D1B8A
                                                                                    • WSAGetLastError.WSOCK32 ref: 006D1B94
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$socket
                                                                                    • String ID:
                                                                                    • API String ID: 1881357543-0
                                                                                    • Opcode ID: 8d6361b54e0b6e338a07e95890e36f4611fe63d865bde391a5c89506b3cc1e2a
                                                                                    • Instruction ID: a37976690d3dd8288e57091761b050d01065ba2f20fcbbcc79cf694bdb0e0bc6
                                                                                    • Opcode Fuzzy Hash: 8d6361b54e0b6e338a07e95890e36f4611fe63d865bde391a5c89506b3cc1e2a
                                                                                    • Instruction Fuzzy Hash: 0D419134600200AFE760AF24C886F6677E6AB85718F54845DF95A9F3D2D7B2ED42CB90
                                                                                    Function 0068B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 65f8797cd6111cc3750324a9fe6715568bd6be519186a57d2c052f8931209711
                                                                                    • Instruction ID: 17d38c8ff294a3e14b42d0f943f9f65f3bb2d94681ddfb394c4d654a93a0b246
                                                                                    • Opcode Fuzzy Hash: 65f8797cd6111cc3750324a9fe6715568bd6be519186a57d2c052f8931209711
                                                                                    • Instruction Fuzzy Hash: 27412A75A00304AFD724AF78CC42BAA7BEBEF84720F20462EF556DB792D37199018790
                                                                                    Function 006C56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 006C5783
                                                                                    • GetLastError.KERNEL32(?,00000000), ref: 006C57A9
                                                                                    • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 006C57CE
                                                                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 006C57FA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                    • String ID:
                                                                                    • API String ID: 3321077145-0
                                                                                    • Opcode ID: 538ea74a402f031173a76930bf7c87932fab71a813f4f12571b1170ed1ca2f84
                                                                                    • Instruction ID: 26cf1b296a7cabd35c118fa7914487e5266328a13ea7705e97e7564cc8b5bf1a
                                                                                    • Opcode Fuzzy Hash: 538ea74a402f031173a76930bf7c87932fab71a813f4f12571b1170ed1ca2f84
                                                                                    • Instruction Fuzzy Hash: 8F411639600610DFCB11EF15C484A5ABBE2EF89321F19848CEC5AAB362DB31FD45CB95
                                                                                    Function 0068D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,?,00676D71,00000000,00000000,006782D9,?,006782D9,?,00000001,00676D71,?,00000001,006782D9,006782D9), ref: 0068D910
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0068D999
                                                                                    • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0068D9AB
                                                                                    • __freea.LIBCMT ref: 0068D9B4
                                                                                      • Part of subcall function 00683820: RtlAllocateHeap.NTDLL(00000000,?,00721444,?,0066FDF5,?,?,0065A976,00000010,00721440,006513FC,?,006513C6,?,00651129), ref: 00683852
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                    • String ID:
                                                                                    • API String ID: 2652629310-0
                                                                                    • Opcode ID: 7aeb9ff4a07e8a4ce6e33a594d8dd0fc42b2316f89bde64d351f1e489d960765
                                                                                    • Instruction ID: 4cb3dc7838fa0df51f6529037c5109534e50ad062315115aa5557897a10f032d
                                                                                    • Opcode Fuzzy Hash: 7aeb9ff4a07e8a4ce6e33a594d8dd0fc42b2316f89bde64d351f1e489d960765
                                                                                    • Instruction Fuzzy Hash: E131B372A00216ABDF25AF65DC45EEE7BA6EB41710F054268FC08D7290E735CD51CBA0
                                                                                    Function 006E52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(?,00001024,00000000,?), ref: 006E5352
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E5375
                                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 006E5382
                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006E53A8
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: LongWindow$InvalidateMessageRectSend
                                                                                    • String ID:
                                                                                    • API String ID: 3340791633-0
                                                                                    • Opcode ID: c02508e0aa4394f65239f19399256ef8f6d0ef1dad15e0c0e9f6c2069cbf2236
                                                                                    • Instruction ID: 56b09b999df61832e2e9755fd99a3766b8640ca5e0dcb87611eb3f625cc1e7fb
                                                                                    • Opcode Fuzzy Hash: c02508e0aa4394f65239f19399256ef8f6d0ef1dad15e0c0e9f6c2069cbf2236
                                                                                    • Instruction Fuzzy Hash: D6310634A57B88EFEB309B16CC45BE93763AB04394F544001FA12963E1E7B09D419B81
                                                                                    Function 006BAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 006BABF1
                                                                                    • SetKeyboardState.USER32(00000080,?,00008000), ref: 006BAC0D
                                                                                    • PostMessageW.USER32(00000000,00000101,00000000), ref: 006BAC74
                                                                                    • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 006BACC6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                                    • String ID:
                                                                                    • API String ID: 432972143-0
                                                                                    • Opcode ID: eff96aa7bf0e5b503682db4fda3385d158e8885932816fe27ef8e1b1d1da64a7
                                                                                    • Instruction ID: e9b69f10ddb2581ff34100de424c572a3c617a1199243b857459ebb97227142f
                                                                                    • Opcode Fuzzy Hash: eff96aa7bf0e5b503682db4fda3385d158e8885932816fe27ef8e1b1d1da64a7
                                                                                    • Instruction Fuzzy Hash: EE3137B0A003586FEF35CBA48C457FE7FA7AB89320F04431AE481963D1D37489C287A2
                                                                                    Function 006E7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ClientToScreen.USER32(?,?), ref: 006E769A
                                                                                    • GetWindowRect.USER32(?,?), ref: 006E7710
                                                                                    • PtInRect.USER32(?,?,006E8B89), ref: 006E7720
                                                                                    • MessageBeep.USER32(00000000), ref: 006E778C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Rect$BeepClientMessageScreenWindow
                                                                                    • String ID:
                                                                                    • API String ID: 1352109105-0
                                                                                    • Opcode ID: 3d520e8808a47ddc3c89bf0be3958cdaebbb335cf192478d7a4f62c03433eff2
                                                                                    • Instruction ID: 0644a4235164fe8abe518b67a728a38b757f1da0b709d7207e5f5468be6a03b2
                                                                                    • Opcode Fuzzy Hash: 3d520e8808a47ddc3c89bf0be3958cdaebbb335cf192478d7a4f62c03433eff2
                                                                                    • Instruction Fuzzy Hash: B7418D3460A394DFDF11CF5AD894EA9B7F6FB59314F1980A8E8549B361C730A982CF90
                                                                                    Function 006E16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetForegroundWindow.USER32 ref: 006E16EB
                                                                                      • Part of subcall function 006B3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 006B3A57
                                                                                      • Part of subcall function 006B3A3D: GetCurrentThreadId.KERNEL32 ref: 006B3A5E
                                                                                      • Part of subcall function 006B3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006B25B3), ref: 006B3A65
                                                                                    • GetCaretPos.USER32(?), ref: 006E16FF
                                                                                    • ClientToScreen.USER32(00000000,?), ref: 006E174C
                                                                                    • GetForegroundWindow.USER32 ref: 006E1752
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                    • String ID:
                                                                                    • API String ID: 2759813231-0
                                                                                    • Opcode ID: bd3f1e2b3f9118baeaf5f6de6ac63f7ce70e53d5f79d9e7d3b91f13e98876742
                                                                                    • Instruction ID: a31a1facf34ac2f89f07d65e31a991aab67bd5ab29dc576a1caf391b28b44dab
                                                                                    • Opcode Fuzzy Hash: bd3f1e2b3f9118baeaf5f6de6ac63f7ce70e53d5f79d9e7d3b91f13e98876742
                                                                                    • Instruction Fuzzy Hash: B6314171D00249AFCB40EFAAC881CEEB7FAEF49314B50806DE415EB251D7319E45CBA0
                                                                                    Function 006E8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00669BB2
                                                                                    • GetCursorPos.USER32(?), ref: 006E9001
                                                                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,006A7711,?,?,?,?,?), ref: 006E9016
                                                                                    • GetCursorPos.USER32(?), ref: 006E905E
                                                                                    • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,006A7711,?,?,?), ref: 006E9094
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                                    • String ID:
                                                                                    • API String ID: 2864067406-0
                                                                                    • Opcode ID: 1549269f29239c41ebc6c1ac1540a0818e9f3ccefb6679b28d2c4bba512f3016
                                                                                    • Instruction ID: ccbf9b685b39d96ec0e35c73d2e5cda8135542cabe052cd7cf566a9fdeb14c69
                                                                                    • Opcode Fuzzy Hash: 1549269f29239c41ebc6c1ac1540a0818e9f3ccefb6679b28d2c4bba512f3016
                                                                                    • Instruction Fuzzy Hash: 6021D331601258EFCB258F95CC98EFA3BBAFF4A360F444059F9054B261C335AA91DB70
                                                                                    Function 006BD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetFileAttributesW.KERNEL32(?,006ECB68), ref: 006BD2FB
                                                                                    • GetLastError.KERNEL32 ref: 006BD30A
                                                                                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 006BD319
                                                                                    • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,006ECB68), ref: 006BD376
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                    • String ID:
                                                                                    • API String ID: 2267087916-0
                                                                                    • Opcode ID: 30d2ca2b2478cebd7e874b0a82ca4c2d74f6560209bbb26d67aec567c09974eb
                                                                                    • Instruction ID: f323a7a867ae3093dfb9ebf96c2e74027428a82266b703f68c06902bd87053e8
                                                                                    • Opcode Fuzzy Hash: 30d2ca2b2478cebd7e874b0a82ca4c2d74f6560209bbb26d67aec567c09974eb
                                                                                    • Instruction Fuzzy Hash: 732186B0505301DFC714DF24C8814EA77E6EE56764F104A1DF895CB2A2EB31D98ACB97
                                                                                    Function 006B1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006B102A
                                                                                      • Part of subcall function 006B1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006B1036
                                                                                      • Part of subcall function 006B1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006B1045
                                                                                      • Part of subcall function 006B1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006B104C
                                                                                      • Part of subcall function 006B1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006B1062
                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 006B15BE
                                                                                    • _memcmp.LIBVCRUNTIME ref: 006B15E1
                                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006B1617
                                                                                    • HeapFree.KERNEL32(00000000), ref: 006B161E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                                                    • String ID:
                                                                                    • API String ID: 1592001646-0
                                                                                    • Opcode ID: 35f946393e8da4e00b34d4830a531fe9f85547146acc9226820ca4272fdf4bcf
                                                                                    • Instruction ID: 37ec1cd0ae5b92734dac5bfe0e2de9dae1cc88b24d693f3ef9040b1072379836
                                                                                    • Opcode Fuzzy Hash: 35f946393e8da4e00b34d4830a531fe9f85547146acc9226820ca4272fdf4bcf
                                                                                    • Instruction Fuzzy Hash: 642190B2E00218FFDF10DFA4C955BEEB7BAEF46354F484459E441AB241E730AA45DB90
                                                                                    Function 006E2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 006E280A
                                                                                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 006E2824
                                                                                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 006E2832
                                                                                    • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 006E2840
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Long$AttributesLayered
                                                                                    • String ID:
                                                                                    • API String ID: 2169480361-0
                                                                                    • Opcode ID: 5940a9fab54ec86b9df8623d540ad5d92e591f2783d5617751072a36f4950228
                                                                                    • Instruction ID: 9d5c2d7313007983fbc891dd57d514720ffa75b9a6a3376ba3038b4a5464971b
                                                                                    • Opcode Fuzzy Hash: 5940a9fab54ec86b9df8623d540ad5d92e591f2783d5617751072a36f4950228
                                                                                    • Instruction Fuzzy Hash: B321C431205792AFD7149B25C855FAA779BAF85324F14815CF8168B6D2C771FC42CB90
                                                                                    Function 006B78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 006B8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,006B790A,?,000000FF,?,006B8754,00000000,?,0000001C,?,?), ref: 006B8D8C
                                                                                      • Part of subcall function 006B8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 006B8DB2
                                                                                      • Part of subcall function 006B8D7D: lstrcmpiW.KERNEL32(00000000,?,006B790A,?,000000FF,?,006B8754,00000000,?,0000001C,?,?), ref: 006B8DE3
                                                                                    • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,006B8754,00000000,?,0000001C,?,?,00000000), ref: 006B7923
                                                                                    • lstrcpyW.KERNEL32(00000000,?), ref: 006B7949
                                                                                    • lstrcmpiW.KERNEL32(00000002,cdecl,?,006B8754,00000000,?,0000001C,?,?,00000000), ref: 006B7984
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: lstrcmpilstrcpylstrlen
                                                                                    • String ID: cdecl
                                                                                    • API String ID: 4031866154-3896280584
                                                                                    • Opcode ID: 8cd9b7318b2965f59a84dfc267b532b41f77fd602313cc51bd75a4a10c9ffc54
                                                                                    • Instruction ID: 06aa1e2b67b6deedc99fca905ef813dfd78df09938fa78f814fe7a0b6e6971ba
                                                                                    • Opcode Fuzzy Hash: 8cd9b7318b2965f59a84dfc267b532b41f77fd602313cc51bd75a4a10c9ffc54
                                                                                    • Instruction Fuzzy Hash: 5211037A200342AFCB15AF38D844DFA77AAFF85350B00402EF802CB3A4EB319851C7A1
                                                                                    Function 006E7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 006E7D0B
                                                                                    • SetWindowLongW.USER32(00000000,000000F0,?), ref: 006E7D2A
                                                                                    • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 006E7D42
                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,006CB7AD,00000000), ref: 006E7D6B
                                                                                      • Part of subcall function 00669BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00669BB2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$Long
                                                                                    • String ID:
                                                                                    • API String ID: 847901565-0
                                                                                    • Opcode ID: 770891f15f83597133b9e6bfd3cf2555b2085c4a22f87ea64064d4a545220e66
                                                                                    • Instruction ID: a9ec4f2782af82d4267c9b8235cce4ba89190185d3bca3ccb3c91647130aa68a
                                                                                    • Opcode Fuzzy Hash: 770891f15f83597133b9e6bfd3cf2555b2085c4a22f87ea64064d4a545220e66
                                                                                    • Instruction Fuzzy Hash: 8C118E31506795AFCB109F29CC44AB63BA6BF45370B159724F835DB2E0E7309952DB50
                                                                                    Function 006E5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(?,00001060,?,00000004), ref: 006E56BB
                                                                                    • _wcslen.LIBCMT ref: 006E56CD
                                                                                    • _wcslen.LIBCMT ref: 006E56D8
                                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 006E5816
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend_wcslen
                                                                                    • String ID:
                                                                                    • API String ID: 455545452-0
                                                                                    • Opcode ID: fbf1626541224b5d140dd14f32961991904e6ffeff3db230f92d8205ffe10e76
                                                                                    • Instruction ID: 3e53a9203b072faace01be95beaf66bc35215c887d9601d7b767eb72328b4374
                                                                                    • Opcode Fuzzy Hash: fbf1626541224b5d140dd14f32961991904e6ffeff3db230f92d8205ffe10e76
                                                                                    • Instruction Fuzzy Hash: 4411037160179996DF209F62CCC5AEE37ADEF10368F10802AF916DA181EB70CA85CB64
                                                                                    Function 00681D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f2c5ea4f688b81a539ae26a0480e1c0cf047591d5cd736830a0d0f3dab0d680e
                                                                                    • Instruction ID: ec4eb159b0a1e3f1bf64f4d283154c893bb46928964953109cd99a15894590e0
                                                                                    • Opcode Fuzzy Hash: f2c5ea4f688b81a539ae26a0480e1c0cf047591d5cd736830a0d0f3dab0d680e
                                                                                    • Instruction Fuzzy Hash: 1901A7B22056167EF75136786CC0FA7662FDF427B4F31172AF521592D2DB608C024374
                                                                                    Function 006B1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 006B1A47
                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 006B1A59
                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 006B1A6F
                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 006B1A8A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend
                                                                                    • String ID:
                                                                                    • API String ID: 3850602802-0
                                                                                    • Opcode ID: c62a4c402195977eb9bbe29104a0ed30387b226257305be28000b5273f635f98
                                                                                    • Instruction ID: ff1f37013a7e81ec53c642513246ce3c2915956445718770f1f73706bfd6f84e
                                                                                    • Opcode Fuzzy Hash: c62a4c402195977eb9bbe29104a0ed30387b226257305be28000b5273f635f98
                                                                                    • Instruction Fuzzy Hash: 3511277A901219FFEB109BA4C985FEDBB79EB08750F200092EA00BB290D6716E51DB94
                                                                                    Function 006BE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 006BE1FD
                                                                                    • MessageBoxW.USER32(?,?,?,?), ref: 006BE230
                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 006BE246
                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 006BE24D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                    • String ID:
                                                                                    • API String ID: 2880819207-0
                                                                                    • Opcode ID: a55356eca1d6595e6b8df77ea84a5833e6e9ab4d1e5a7fdb6b18aafe30814061
                                                                                    • Instruction ID: 8ec302a74391c46f444588a466ffbb1c3231f8a6d1891b8141f867bb19d04f96
                                                                                    • Opcode Fuzzy Hash: a55356eca1d6595e6b8df77ea84a5833e6e9ab4d1e5a7fdb6b18aafe30814061
                                                                                    • Instruction Fuzzy Hash: 5B1144B2D04244BFC710DBA89C49ADE3FAEAB41320F008219F924E3281D2B6CE4187A0
                                                                                    Function 0067D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateThread.KERNEL32(00000000,?,0067CFF9,00000000,00000004,00000000), ref: 0067D218
                                                                                    • GetLastError.KERNEL32 ref: 0067D224
                                                                                    • __dosmaperr.LIBCMT ref: 0067D22B
                                                                                    • ResumeThread.KERNEL32(00000000), ref: 0067D249
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                                                    • String ID:
                                                                                    • API String ID: 173952441-0
                                                                                    • Opcode ID: 137ace452a6d1cb95c657b15a692470c36f709981e2107f85aefcb2d0adc597d
                                                                                    • Instruction ID: 1b436b73d88f37f72a1192313d294db544d635f70f8cbb300fcffd6e98b560c8
                                                                                    • Opcode Fuzzy Hash: 137ace452a6d1cb95c657b15a692470c36f709981e2107f85aefcb2d0adc597d
                                                                                    • Instruction Fuzzy Hash: 5901D236805204BBCB116BA5DC09BEA7A7BDF81731F208619FA39961D1CB708A02C7A0
                                                                                    Function 006E9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00669BB2
                                                                                    • GetClientRect.USER32(?,?), ref: 006E9F31
                                                                                    • GetCursorPos.USER32(?), ref: 006E9F3B
                                                                                    • ScreenToClient.USER32(?,?), ref: 006E9F46
                                                                                    • DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 006E9F7A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Client$CursorLongProcRectScreenWindow
                                                                                    • String ID:
                                                                                    • API String ID: 4127811313-0
                                                                                    • Opcode ID: a30e64ef8f6f1c0b66fd964d65c6d0464fe64584ceb7d1ba91c8c22aed7fde3c
                                                                                    • Instruction ID: 19afbd3e133ddfeb32bd14c5ef55043b3f2d8d885f4525aef443a35033dafe99
                                                                                    • Opcode Fuzzy Hash: a30e64ef8f6f1c0b66fd964d65c6d0464fe64584ceb7d1ba91c8c22aed7fde3c
                                                                                    • Instruction Fuzzy Hash: D811457290139AABDB10DFAAD8899EE77BAFF05321F400455F911E7141D330BA92CBB5
                                                                                    Function 0065600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0065604C
                                                                                    • GetStockObject.GDI32(00000011), ref: 00656060
                                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 0065606A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateMessageObjectSendStockWindow
                                                                                    • String ID:
                                                                                    • API String ID: 3970641297-0
                                                                                    • Opcode ID: cf0d40e649dcf800ddc173f195d8ad180bf1aeaed9bbc086cda0b64c4944bd8c
                                                                                    • Instruction ID: 6adb2a5bc5cd0f358b2aa2160c3b9f255a8389ef92d7a083536b886e43fa332c
                                                                                    • Opcode Fuzzy Hash: cf0d40e649dcf800ddc173f195d8ad180bf1aeaed9bbc086cda0b64c4944bd8c
                                                                                    • Instruction Fuzzy Hash: 6211AD72101648BFEF124FA4CD94EEABB6AFF083A5F400205FE0457160C7329C61EBA0
                                                                                    Function 00673B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___BuildCatchObject.LIBVCRUNTIME ref: 00673B56
                                                                                      • Part of subcall function 00673AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00673AD2
                                                                                      • Part of subcall function 00673AA3: ___AdjustPointer.LIBCMT ref: 00673AED
                                                                                    • _UnwindNestedFrames.LIBCMT ref: 00673B6B
                                                                                    • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00673B7C
                                                                                    • CallCatchBlock.LIBVCRUNTIME ref: 00673BA4
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                                                    • String ID:
                                                                                    • API String ID: 737400349-0
                                                                                    • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                                    • Instruction ID: ca079d8a86f37a092ab089d86a4a51226521ad18528fd97d44191ecc8a7f6e82
                                                                                    • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                                    • Instruction Fuzzy Hash: 44014C32100148BBDF125EA5CC46EEB3F6EEF58B54F048018FE5C56221D732E961EBA4
                                                                                    Function 00683073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006513C6,00000000,00000000,?,0068301A,006513C6,00000000,00000000,00000000,?,0068328B,00000006,FlsSetValue), ref: 006830A5
                                                                                    • GetLastError.KERNEL32(?,0068301A,006513C6,00000000,00000000,00000000,?,0068328B,00000006,FlsSetValue,006F2290,FlsSetValue,00000000,00000364,?,00682E46), ref: 006830B1
                                                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0068301A,006513C6,00000000,00000000,00000000,?,0068328B,00000006,FlsSetValue,006F2290,FlsSetValue,00000000), ref: 006830BF
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: LibraryLoad$ErrorLast
                                                                                    • String ID:
                                                                                    • API String ID: 3177248105-0
                                                                                    • Opcode ID: d4c50d3dc2b26b23526e8baeded34505a232ef3385fa8f9a04f1ea60ec4c22c0
                                                                                    • Instruction ID: cb9c069e7368f1dd8b97214715189c4f9dbf5fecd2625a83bc3a8c092448f210
                                                                                    • Opcode Fuzzy Hash: d4c50d3dc2b26b23526e8baeded34505a232ef3385fa8f9a04f1ea60ec4c22c0
                                                                                    • Instruction Fuzzy Hash: 06018432751332ABCB315BB99C849A77B9AAF45FB1B114720F915EB380D721DA02C7E0
                                                                                    Function 006B7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 006B747F
                                                                                    • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 006B7497
                                                                                    • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 006B74AC
                                                                                    • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 006B74CA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Type$Register$FileLoadModuleNameUser
                                                                                    • String ID:
                                                                                    • API String ID: 1352324309-0
                                                                                    • Opcode ID: 7157ffb1be683388330b1181f97f3a8d43fcf83d1e886a91f44c391a1f4ff5b9
                                                                                    • Instruction ID: e943e758efebd70398bdcafa8b485637525d51327c1250d5180540920c6dd882
                                                                                    • Opcode Fuzzy Hash: 7157ffb1be683388330b1181f97f3a8d43fcf83d1e886a91f44c391a1f4ff5b9
                                                                                    • Instruction Fuzzy Hash: D311ADF1205314ABE720CF14DC48FD27BFEEB80B11F108569EA2ADA191D7B0E985DB60
                                                                                    Function 006BB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,006BACD3,?,00008000), ref: 006BB0C4
                                                                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,006BACD3,?,00008000), ref: 006BB0E9
                                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,006BACD3,?,00008000), ref: 006BB0F3
                                                                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,006BACD3,?,00008000), ref: 006BB126
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CounterPerformanceQuerySleep
                                                                                    • String ID:
                                                                                    • API String ID: 2875609808-0
                                                                                    • Opcode ID: 19e77acfc760329629ecec70df245e289f69a7614d638e0ffa399598af6ac073
                                                                                    • Instruction ID: 52c08ba1df1c411c87e0b917f003d4788e0d0ce4c80df0dd903ca815934f995d
                                                                                    • Opcode Fuzzy Hash: 19e77acfc760329629ecec70df245e289f69a7614d638e0ffa399598af6ac073
                                                                                    • Instruction Fuzzy Hash: C6116D71C0162CE7CF00AFE8E9986FEBB79FF0A721F105089D941B6285CBB096918B55
                                                                                    Function 006E7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetWindowRect.USER32(?,?), ref: 006E7E33
                                                                                    • ScreenToClient.USER32(?,?), ref: 006E7E4B
                                                                                    • ScreenToClient.USER32(?,?), ref: 006E7E6F
                                                                                    • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E7E8A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClientRectScreen$InvalidateWindow
                                                                                    • String ID:
                                                                                    • API String ID: 357397906-0
                                                                                    • Opcode ID: 73c9f6a53d7a5be2c487687fbd64d0ba8aa87e53f6dd01dc589da2e785e62378
                                                                                    • Instruction ID: aebc80c65fd1f1f3ec52488f341a7749ee266b90d8d5ca9243d9c46483fc64ce
                                                                                    • Opcode Fuzzy Hash: 73c9f6a53d7a5be2c487687fbd64d0ba8aa87e53f6dd01dc589da2e785e62378
                                                                                    • Instruction Fuzzy Hash: 471140B9D0024AAFDB41CF99D884AEEBBF9FB18310F509066E915E2210D735AA55CF90
                                                                                    Function 006B2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 006B2DC5
                                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 006B2DD6
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 006B2DDD
                                                                                    • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 006B2DE4
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                    • String ID:
                                                                                    • API String ID: 2710830443-0
                                                                                    • Opcode ID: ccb91aeb7810994fbf26273a6da296c7d0b58a1aa8d1eb4d770782d70e929227
                                                                                    • Instruction ID: c33fb758003fa2120518bf50609377e7b02219514da59986cbb52f1e6fd39d4f
                                                                                    • Opcode Fuzzy Hash: ccb91aeb7810994fbf26273a6da296c7d0b58a1aa8d1eb4d770782d70e929227
                                                                                    • Instruction Fuzzy Hash: F7E092B2141324BBDB201B729C4DFEB7FAEEF42BB1F001019F105D50809AA0C882D7B0
                                                                                    Function 006E8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00669639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00669693
                                                                                      • Part of subcall function 00669639: SelectObject.GDI32(?,00000000), ref: 006696A2
                                                                                      • Part of subcall function 00669639: BeginPath.GDI32(?), ref: 006696B9
                                                                                      • Part of subcall function 00669639: SelectObject.GDI32(?,00000000), ref: 006696E2
                                                                                    • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 006E8887
                                                                                    • LineTo.GDI32(?,?,?), ref: 006E8894
                                                                                    • EndPath.GDI32(?), ref: 006E88A4
                                                                                    • StrokePath.GDI32(?), ref: 006E88B2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                                    • String ID:
                                                                                    • API String ID: 1539411459-0
                                                                                    • Opcode ID: ce9cc8e70e10a3f375bdba39f88198c76d9c9427ec6c3af9f672f26464e3c8d1
                                                                                    • Instruction ID: 34b69e29471d32af14d50ee93f97794cd34db43e824aa69695ede4ed89c2a490
                                                                                    • Opcode Fuzzy Hash: ce9cc8e70e10a3f375bdba39f88198c76d9c9427ec6c3af9f672f26464e3c8d1
                                                                                    • Instruction Fuzzy Hash: F7F03A36042398BAEB125F94AC09FCA3A5AAF16320F448004FE11691E1C7795552CBA9
                                                                                    Function 006698B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetSysColor.USER32(00000008), ref: 006698CC
                                                                                    • SetTextColor.GDI32(?,?), ref: 006698D6
                                                                                    • SetBkMode.GDI32(?,00000001), ref: 006698E9
                                                                                    • GetStockObject.GDI32(00000005), ref: 006698F1
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Color$ModeObjectStockText
                                                                                    • String ID:
                                                                                    • API String ID: 4037423528-0
                                                                                    • Opcode ID: 6aa2f487a9bb9e352665bc3539a06f6e18499843892d7e8b04278deba8bb4bb8
                                                                                    • Instruction ID: 288a0338cb435bd1de2d42bede9cd5c945246288a2aae1dc48a368e3623693d1
                                                                                    • Opcode Fuzzy Hash: 6aa2f487a9bb9e352665bc3539a06f6e18499843892d7e8b04278deba8bb4bb8
                                                                                    • Instruction Fuzzy Hash: 98E06D31244780AADB215B78EC49BE83F62EB12336F048219F6FA581E1C7714A559F20
                                                                                    Function 006B162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentThread.KERNEL32 ref: 006B1634
                                                                                    • OpenThreadToken.ADVAPI32(00000000,?,?,?,006B11D9), ref: 006B163B
                                                                                    • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,006B11D9), ref: 006B1648
                                                                                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,006B11D9), ref: 006B164F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CurrentOpenProcessThreadToken
                                                                                    • String ID:
                                                                                    • API String ID: 3974789173-0
                                                                                    • Opcode ID: 31956d0b8f8574a81d0e27eebf7b9330e30715acbbea8c8fdda5e085ab659fa3
                                                                                    • Instruction ID: 59f0a6ad0c96b29788c9c8cf772462875b91e61b36d73fc050e94adf069f55bc
                                                                                    • Opcode Fuzzy Hash: 31956d0b8f8574a81d0e27eebf7b9330e30715acbbea8c8fdda5e085ab659fa3
                                                                                    • Instruction Fuzzy Hash: 2CE04672602311EBD7201BA4AE4DB8A3B6AAF457A2F148808F745CD080E72484828B60
                                                                                    Function 006AD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetDesktopWindow.USER32 ref: 006AD858
                                                                                    • GetDC.USER32(00000000), ref: 006AD862
                                                                                    • GetDeviceCaps.GDI32(00000000,0000000C), ref: 006AD882
                                                                                    • ReleaseDC.USER32(?), ref: 006AD8A3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CapsDesktopDeviceReleaseWindow
                                                                                    • String ID:
                                                                                    • API String ID: 2889604237-0
                                                                                    • Opcode ID: 9714394c17c5382025e6024ce2aad5eb4ab3bf0b9301092c752b9b8ea1ea0f58
                                                                                    • Instruction ID: fe134850df5083ea982d0dcfe0f9223b84205fecc21cc9a1749141d98298d355
                                                                                    • Opcode Fuzzy Hash: 9714394c17c5382025e6024ce2aad5eb4ab3bf0b9301092c752b9b8ea1ea0f58
                                                                                    • Instruction Fuzzy Hash: 5BE01AB4900304EFCF41AFA4D84C66EBBB3FB48321F109409E816EB250C7384902AF40
                                                                                    Function 006AD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetDesktopWindow.USER32 ref: 006AD86C
                                                                                    • GetDC.USER32(00000000), ref: 006AD876
                                                                                    • GetDeviceCaps.GDI32(00000000,0000000C), ref: 006AD882
                                                                                    • ReleaseDC.USER32(?), ref: 006AD8A3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CapsDesktopDeviceReleaseWindow
                                                                                    • String ID:
                                                                                    • API String ID: 2889604237-0
                                                                                    • Opcode ID: a7d35913ae4d1b67884914679151d27810d0fbbadc745e79d9147f670ce73515
                                                                                    • Instruction ID: 898688fb5762ae39f9f6fb38d3bc9b0536f8836728ef1786a528c9d2e03b9c48
                                                                                    • Opcode Fuzzy Hash: a7d35913ae4d1b67884914679151d27810d0fbbadc745e79d9147f670ce73515
                                                                                    • Instruction Fuzzy Hash: 63E01A74C00300DFCF409FA4D84C66EBBB2BB48321F109408E816EB250C73859029F40
                                                                                    Function 006C4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00657620: _wcslen.LIBCMT ref: 00657625
                                                                                    • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 006C4ED4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Connection_wcslen
                                                                                    • String ID: *$LPT
                                                                                    • API String ID: 1725874428-3443410124
                                                                                    • Opcode ID: a2f37cf2ad4885320ded8a50c8de4bb166ac8e62f89b381627885c57bfc3c28c
                                                                                    • Instruction ID: 7eaded9141a6f5c1f6c054471659ba7932db8b987795bffc0fff8de09e40dbde
                                                                                    • Opcode Fuzzy Hash: a2f37cf2ad4885320ded8a50c8de4bb166ac8e62f89b381627885c57bfc3c28c
                                                                                    • Instruction Fuzzy Hash: 59914C75A002049FDB14DF58C494FAABBF2EF88304F15809DE85A9B362DB35ED85CB90
                                                                                    Function 0067E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __startOneArgErrorHandling.LIBCMT ref: 0067E30D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ErrorHandling__start
                                                                                    • String ID: pow
                                                                                    • API String ID: 3213639722-2276729525
                                                                                    • Opcode ID: 01511409cca20cbf16cc6d91f454d27cde9e01323d1e77b0672bbd68e45aa5ee
                                                                                    • Instruction ID: a1db56a41300e2aad20829b7877bc4406c9c50f5b65f15d281c7f595901cc9d7
                                                                                    • Opcode Fuzzy Hash: 01511409cca20cbf16cc6d91f454d27cde9e01323d1e77b0672bbd68e45aa5ee
                                                                                    • Instruction Fuzzy Hash: EF515C61A0C20296CB117714C9453F93BA7AF54750F34CAD8E099433A9EB36CD99DF4A
                                                                                    Function 006D7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CharUpperBuffW.USER32(006A569E,00000000,?,006ECC08,?,00000000,00000000), ref: 006D78DD
                                                                                      • Part of subcall function 00656B57: _wcslen.LIBCMT ref: 00656B6A
                                                                                    • CharUpperBuffW.USER32(006A569E,00000000,?,006ECC08,00000000,?,00000000,00000000), ref: 006D783B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: BuffCharUpper$_wcslen
                                                                                    • String ID: <sq
                                                                                    • API String ID: 3544283678-4045450873
                                                                                    • Opcode ID: 59b2fa53b2cb79f25271c02f9ae54ca8d98112522c744441530df663f09786ae
                                                                                    • Instruction ID: 25ac14c69b71667668663f9da2fc7a87494612f9590d9dee1cf45cff3821420d
                                                                                    • Opcode Fuzzy Hash: 59b2fa53b2cb79f25271c02f9ae54ca8d98112522c744441530df663f09786ae
                                                                                    • Instruction Fuzzy Hash: 5C617C72914228AACF44EBE4CCA1DFDB376BF14701F44052AF942A7291FF245A09DBA5
                                                                                    Function 0066E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: #
                                                                                    • API String ID: 0-1885708031
                                                                                    • Opcode ID: ecbf1ec8299e26a9e2fb4ead6cac29f5f3f7cb737720a5db8a6bda69ede4de94
                                                                                    • Instruction ID: 58e58c6021b2775f0113edccd7c6f4caa033b1a651cd6cce1ea4b0973406b949
                                                                                    • Opcode Fuzzy Hash: ecbf1ec8299e26a9e2fb4ead6cac29f5f3f7cb737720a5db8a6bda69ede4de94
                                                                                    • Instruction Fuzzy Hash: 3D511279500246DFDB19EF28C4916FA7BABEF56310F244059EC919B3C0DA36DE46CBA0
                                                                                    Function 0066F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • Sleep.KERNEL32(00000000), ref: 0066F2A2
                                                                                    • GlobalMemoryStatusEx.KERNEL32(?), ref: 0066F2BB
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: GlobalMemorySleepStatus
                                                                                    • String ID: @
                                                                                    • API String ID: 2783356886-2766056989
                                                                                    • Opcode ID: f270c4889641e67ae8eac70c31b872a31de1394cfcf3ff4f2c3fa27c4b4402ed
                                                                                    • Instruction ID: c719b54888bc59047aaae9da9aff9ff8ec641f605e0fc289abf16432336881c3
                                                                                    • Opcode Fuzzy Hash: f270c4889641e67ae8eac70c31b872a31de1394cfcf3ff4f2c3fa27c4b4402ed
                                                                                    • Instruction Fuzzy Hash: 0C5135714087449BD360AF10EC86BAFBBF9FF84311F81885DF5D9411A5EB309529CB6A
                                                                                    Function 006D5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 006D57E0
                                                                                    • _wcslen.LIBCMT ref: 006D57EC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: BuffCharUpper_wcslen
                                                                                    • String ID: CALLARGARRAY
                                                                                    • API String ID: 157775604-1150593374
                                                                                    • Opcode ID: 8ee92823508f2c6a749ad6091b5060931ec1572985e56aaaa77aaf3c826fac09
                                                                                    • Instruction ID: 3e99cfcee0a40f78f4fcfa091a9339df9c9280349ada86d4e3ad87f5f3a34d90
                                                                                    • Opcode Fuzzy Hash: 8ee92823508f2c6a749ad6091b5060931ec1572985e56aaaa77aaf3c826fac09
                                                                                    • Instruction Fuzzy Hash: C1419F71E002199FCB14DFA9C8858EEBBB6FF59324F10406EE506A7351EB349D81DB90
                                                                                    Function 006CD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _wcslen.LIBCMT ref: 006CD130
                                                                                    • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 006CD13A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CrackInternet_wcslen
                                                                                    • String ID: |
                                                                                    • API String ID: 596671847-2343686810
                                                                                    • Opcode ID: 6b860e58a8426a759fd1b90275a9ddff8df916f38803fb39fa52ac43a311f982
                                                                                    • Instruction ID: 8ef7ca3bffc1104f4799681777ed92f17146bdf0d3cae07b0d2740d1082526b6
                                                                                    • Opcode Fuzzy Hash: 6b860e58a8426a759fd1b90275a9ddff8df916f38803fb39fa52ac43a311f982
                                                                                    • Instruction Fuzzy Hash: 70310971D01209ABCF55EFA4CC85EEE7FBAFF04304F000029F815A6265D731AA46CB54
                                                                                    Function 006E356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DestroyWindow.USER32(?,?,?,?), ref: 006E3621
                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 006E365C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$DestroyMove
                                                                                    • String ID: static
                                                                                    • API String ID: 2139405536-2160076837
                                                                                    • Opcode ID: 6723d942675f59931c4b83341cbff2768d6e744e4ee9004f1f685b696abf0d10
                                                                                    • Instruction ID: 0435fe1912508370ee73de48ad51ec1752d2822ce67c859b7236d6b8fe2009bc
                                                                                    • Opcode Fuzzy Hash: 6723d942675f59931c4b83341cbff2768d6e744e4ee9004f1f685b696abf0d10
                                                                                    • Instruction Fuzzy Hash: FA318C71110344AEDB109F79DC85AFB73AAFF88720F10961DF8A597280DA31AD82D764
                                                                                    Function 006E4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 006E461F
                                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 006E4634
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend
                                                                                    • String ID: '
                                                                                    • API String ID: 3850602802-1997036262
                                                                                    • Opcode ID: 39261f41eee8505fb7317690fbd67b4b859395a6181bf3ebc2e8e35402b94c0d
                                                                                    • Instruction ID: 05d352d3aa945959b4bd7bf07d8062a90a9b2512f718ed6ee8a47f07ef7f601f
                                                                                    • Opcode Fuzzy Hash: 39261f41eee8505fb7317690fbd67b4b859395a6181bf3ebc2e8e35402b94c0d
                                                                                    • Instruction Fuzzy Hash: 7F312C74A023599FDF14CFAAC990BDA7BB6FF49340F144069E905AB351DB70A942CF90
                                                                                    Function 006E31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 006E327C
                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006E3287
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessageSend
                                                                                    • String ID: Combobox
                                                                                    • API String ID: 3850602802-2096851135
                                                                                    • Opcode ID: 849ddf4dd9087b0d554254b8899f8ff8f1fbf98355dfef768c18a26de37972ab
                                                                                    • Instruction ID: c624513b46522c5c7074b3d4c3f2d5893f7aea26d92c8826cd501fbb34469c5c
                                                                                    • Opcode Fuzzy Hash: 849ddf4dd9087b0d554254b8899f8ff8f1fbf98355dfef768c18a26de37972ab
                                                                                    • Instruction Fuzzy Hash: 5711D0712012586FEF219F55DC88EEB37ABEB94364F104128FA5897390D6319E518760
                                                                                    Function 006E3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0065600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0065604C
                                                                                      • Part of subcall function 0065600E: GetStockObject.GDI32(00000011), ref: 00656060
                                                                                      • Part of subcall function 0065600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0065606A
                                                                                    • GetWindowRect.USER32(00000000,?), ref: 006E377A
                                                                                    • GetSysColor.USER32(00000012), ref: 006E3794
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                                    • String ID: static
                                                                                    • API String ID: 1983116058-2160076837
                                                                                    • Opcode ID: 8987735f5a8efb17c61719c062599b925a890272ffba6023ba91fdb73b602fb7
                                                                                    • Instruction ID: 5741c4c93f9d2554ffeb95fd6074904a27e31d27ecc95d799b59daa4fea6c0e7
                                                                                    • Opcode Fuzzy Hash: 8987735f5a8efb17c61719c062599b925a890272ffba6023ba91fdb73b602fb7
                                                                                    • Instruction Fuzzy Hash: C41159B2610259AFDF10DFA8CC49AEA7BBAFB08314F004514F955E3250D734E811DB50
                                                                                    Function 006CCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 006CCD7D
                                                                                    • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 006CCDA6
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Internet$OpenOption
                                                                                    • String ID: <local>
                                                                                    • API String ID: 942729171-4266983199
                                                                                    • Opcode ID: 94225ed7f6a68a4a4b22ce8478955d63a9eefd8d6e6fd77608bfcaadd0b7f011
                                                                                    • Instruction ID: b39e85baf65088a078f220c9b30863da062e1cbb6ae1657fc0a1a3efb890173d
                                                                                    • Opcode Fuzzy Hash: 94225ed7f6a68a4a4b22ce8478955d63a9eefd8d6e6fd77608bfcaadd0b7f011
                                                                                    • Instruction Fuzzy Hash: AA11A371605632BAD7244B669C85FF7BE6AEF527B4F00422AF10E87180D674A841D6F0
                                                                                    Function 006E3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetWindowTextLengthW.USER32(00000000), ref: 006E34AB
                                                                                    • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006E34BA
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: LengthMessageSendTextWindow
                                                                                    • String ID: edit
                                                                                    • API String ID: 2978978980-2167791130
                                                                                    • Opcode ID: 34747e96e80379e6786feb7b266689a57e1bc931b96d166ad87ad52902a2fcc2
                                                                                    • Instruction ID: c54a1c039dc4d5a77e57fe7306773c15c3af4e780d6f361b24653ecf0661c3cd
                                                                                    • Opcode Fuzzy Hash: 34747e96e80379e6786feb7b266689a57e1bc931b96d166ad87ad52902a2fcc2
                                                                                    • Instruction Fuzzy Hash: 35119D71101398EAEB128E65DC88AEB37ABEB05374F504324F960973D0C731DD529B50
                                                                                    Function 006B6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    • CharUpperBuffW.USER32(?,?,?), ref: 006B6CB6
                                                                                    • _wcslen.LIBCMT ref: 006B6CC2
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen$BuffCharUpper
                                                                                    • String ID: STOP
                                                                                    • API String ID: 1256254125-2411985666
                                                                                    • Opcode ID: d201fe7b18bf335ee27f49e2229294165230da84a837952450c9806fb9346d8a
                                                                                    • Instruction ID: 6e5e7bd49e91434f17bb302e2b491c6e17604dce7ee37cab27697e235906ec08
                                                                                    • Opcode Fuzzy Hash: d201fe7b18bf335ee27f49e2229294165230da84a837952450c9806fb9346d8a
                                                                                    • Instruction Fuzzy Hash: 810104726105268BCB209FBDCC918FF3BB7EE61710B000928F85296290EB39D885C750
                                                                                    Function 006B1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006B3CCA
                                                                                    • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 006B1D4C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClassMessageNameSend_wcslen
                                                                                    • String ID: ComboBox$ListBox
                                                                                    • API String ID: 624084870-1403004172
                                                                                    • Opcode ID: 361d56875c737278c526b6b0cb8d42d3c251fb169e657a8db252b27bcfffde4f
                                                                                    • Instruction ID: 58f427eabe91fc2db2dd15dae205af557d283f339cc58e0ee8ce66573a6342af
                                                                                    • Opcode Fuzzy Hash: 361d56875c737278c526b6b0cb8d42d3c251fb169e657a8db252b27bcfffde4f
                                                                                    • Instruction Fuzzy Hash: 2E01B5B5601228AB8B18EBA4CC61CFE776AEF47350B54091DA8225B3C1EA30594D8760
                                                                                    Function 006B1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006B3CCA
                                                                                    • SendMessageW.USER32(?,00000180,00000000,?), ref: 006B1C46
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClassMessageNameSend_wcslen
                                                                                    • String ID: ComboBox$ListBox
                                                                                    • API String ID: 624084870-1403004172
                                                                                    • Opcode ID: 661faf3ab13a148e61db7e80dd5611acda19cc757c54e8bdd319d5ceaf76657f
                                                                                    • Instruction ID: 82f23b012a5538e9030fc5caff958943cfd4df57e1d3a65dd38748ccd1cdb18b
                                                                                    • Opcode Fuzzy Hash: 661faf3ab13a148e61db7e80dd5611acda19cc757c54e8bdd319d5ceaf76657f
                                                                                    • Instruction Fuzzy Hash: 1101F7F5780104B6CB18EB90C962DFF7BAA9B12340F50041DA9066B2C2EB249E4C87B5
                                                                                    Function 006B1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006B3CCA
                                                                                    • SendMessageW.USER32(?,00000182,?,00000000), ref: 006B1CC8
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClassMessageNameSend_wcslen
                                                                                    • String ID: ComboBox$ListBox
                                                                                    • API String ID: 624084870-1403004172
                                                                                    • Opcode ID: d9ff0c8a2d6330e1bcec0a7fcfaf70a371d7429a2d72c4841f06cb540157bfc6
                                                                                    • Instruction ID: 592562e73a80e63568bee34b37826d734efb2d180b9a101d4e882e59ab8fe21c
                                                                                    • Opcode Fuzzy Hash: d9ff0c8a2d6330e1bcec0a7fcfaf70a371d7429a2d72c4841f06cb540157bfc6
                                                                                    • Instruction Fuzzy Hash: 0601A7F5780114B6CB14E794CA11AFE7BAA9B12340F540419BC0177282EB249F498775
                                                                                    Function 0066A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __Init_thread_footer.LIBCMT ref: 0066A529
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Init_thread_footer_wcslen
                                                                                    • String ID: ,%r$3yj
                                                                                    • API String ID: 2551934079-468026085
                                                                                    • Opcode ID: 4132b9de481b9dad570c868b82e68202d9105a538bfdcd59e9b0491e427aa147
                                                                                    • Instruction ID: 743928a0549bf9d9692b4cfae6bc55d9a6de1ec4eace251050eee58a5d2e1c77
                                                                                    • Opcode Fuzzy Hash: 4132b9de481b9dad570c868b82e68202d9105a538bfdcd59e9b0491e427aa147
                                                                                    • Instruction Fuzzy Hash: 9C014731600210D7C500F3A8DC17A9D33579B44720F5080ACF506672C3EE109D028EEF
                                                                                    Function 006B1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00659CB3: _wcslen.LIBCMT ref: 00659CBD
                                                                                      • Part of subcall function 006B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006B3CCA
                                                                                    • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 006B1DD3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ClassMessageNameSend_wcslen
                                                                                    • String ID: ComboBox$ListBox
                                                                                    • API String ID: 624084870-1403004172
                                                                                    • Opcode ID: e55cef57059cb26fed62778089678821b194334fde32932dc86db1cfc5337d31
                                                                                    • Instruction ID: 90b47bd3b598c65c4f5df3801897685353c343bf6ffd4023674a43c6b6ac8120
                                                                                    • Opcode Fuzzy Hash: e55cef57059cb26fed62778089678821b194334fde32932dc86db1cfc5337d31
                                                                                    • Instruction Fuzzy Hash: DEF0A4F5B41214B6DB18E7A4CC62EFF777AAF02350F940D1DB822672C2DA60594C8774
                                                                                    Function 006E8172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00723018,0072305C), ref: 006E81BF
                                                                                    • CloseHandle.KERNEL32 ref: 006E81D1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CloseCreateHandleProcess
                                                                                    • String ID: \0r
                                                                                    • API String ID: 3712363035-4222232613
                                                                                    • Opcode ID: fd23ce3a37e0db7c1aa6f4c0fcc3f3b1c7a1f85528d860449b739c9c654351c3
                                                                                    • Instruction ID: 45600cae8b77503f87e39cbb4aa0bb255ed2c547c2c15d26fd4a2f49ab495a32
                                                                                    • Opcode Fuzzy Hash: fd23ce3a37e0db7c1aa6f4c0fcc3f3b1c7a1f85528d860449b739c9c654351c3
                                                                                    • Instruction Fuzzy Hash: 73F05EB1640310BEF3306765AC45FB73A5EEB04761F008425BB0CDA1A2D67E8A0186BC
                                                                                    Function 006D747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: _wcslen
                                                                                    • String ID: 3, 3, 16, 1
                                                                                    • API String ID: 176396367-3042988571
                                                                                    • Opcode ID: a38cc1d9ce1b9f15efbdd1a0a99c4309ec51f8ed21e8c835a064d447b89b5e78
                                                                                    • Instruction ID: 24063f0b3a7491ed1784f76f31b53466ad969fa92771e2721d2df6ccc38708a3
                                                                                    • Opcode Fuzzy Hash: a38cc1d9ce1b9f15efbdd1a0a99c4309ec51f8ed21e8c835a064d447b89b5e78
                                                                                    • Instruction Fuzzy Hash: 08E02B02A0422011937212799CC59BF57CBCFC5750710182FFA89C2366FF948D9193E6
                                                                                    Function 006B0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 006B0B23
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Message
                                                                                    • String ID: AutoIt$Error allocating memory.
                                                                                    • API String ID: 2030045667-4017498283
                                                                                    • Opcode ID: 261ab4293ef171d59149f8d85d13cbadce4d6f2bcd72695c764c4837e27d7cb3
                                                                                    • Instruction ID: ecb1258c3f24f7641bda76c386f2f9fe2ee2227b692b7f909422c2a740485531
                                                                                    • Opcode Fuzzy Hash: 261ab4293ef171d59149f8d85d13cbadce4d6f2bcd72695c764c4837e27d7cb3
                                                                                    • Instruction Fuzzy Hash: 03E0D83128534836D2543755BC07FC97E878F05F31F10042EFB58955C38BE268D046AD
                                                                                    Function 00670D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0066F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00670D71,?,?,?,0065100A), ref: 0066F7CE
                                                                                    • IsDebuggerPresent.KERNEL32(?,?,?,0065100A), ref: 00670D75
                                                                                    • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0065100A), ref: 00670D84
                                                                                    Strings
                                                                                    • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00670D7F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                                                    • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                    • API String ID: 55579361-631824599
                                                                                    • Opcode ID: 5fb0c9475f004186b2b9e22b09790ebf891d406ea7dafeefde97b856af04410b
                                                                                    • Instruction ID: a4da9176a322873356c3910c1322daa564f5b39dcfd2056ffb2114e5a8a0363b
                                                                                    • Opcode Fuzzy Hash: 5fb0c9475f004186b2b9e22b09790ebf891d406ea7dafeefde97b856af04410b
                                                                                    • Instruction Fuzzy Hash: BEE06D702003818FE3709FB9E8483427BE2BF10744F00892DE486CA651DBB5E4498BA1
                                                                                    Function 0066E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __Init_thread_footer.LIBCMT ref: 0066E3D5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Init_thread_footer
                                                                                    • String ID: 0%r$8%r
                                                                                    • API String ID: 1385522511-2997621168
                                                                                    • Opcode ID: 83cf61958f44a414060dba8bede4eb435ed67b8fea457c0eb20d2a681494ed31
                                                                                    • Instruction ID: 0888b040acbda81cca4028292e5178b788fe109de303f9314db7961ab6d9313d
                                                                                    • Opcode Fuzzy Hash: 83cf61958f44a414060dba8bede4eb435ed67b8fea457c0eb20d2a681494ed31
                                                                                    • Instruction Fuzzy Hash: 8BE02639808A20EBCA14971DF854A883357AF04320B90C1F8E012AB3D3DB3DA8438A5C
                                                                                    Function 006C3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 006C302F
                                                                                    • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 006C3044
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: Temp$FileNamePath
                                                                                    • String ID: aut
                                                                                    • API String ID: 3285503233-3010740371
                                                                                    • Opcode ID: fd5bb263c86c3d43ba352f2cb7e762c3734bf42ac641e821c3190bf92ab4ceff
                                                                                    • Instruction ID: d1f8903298247c4fbd31c2a061ac8a614f1e6c92bc2c2842731623cd4a6a9fee
                                                                                    • Opcode Fuzzy Hash: fd5bb263c86c3d43ba352f2cb7e762c3734bf42ac641e821c3190bf92ab4ceff
                                                                                    • Instruction Fuzzy Hash: 7BD05B715003146BDB2097949C4EFC73A6CDB04761F0001517755D60D1DAB49685CAD0
                                                                                    Function 006AD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: LocalTime
                                                                                    • String ID: %.3d$X64
                                                                                    • API String ID: 481472006-1077770165
                                                                                    • Opcode ID: a329b755c1a19083905634fdeba7fca1e533fdc3fdc97a95676bc84b8261e4e8
                                                                                    • Instruction ID: b856880de8f40bb3d3b0c7906a7e1d2737ec40eb3584328401a53fc9648987d1
                                                                                    • Opcode Fuzzy Hash: a329b755c1a19083905634fdeba7fca1e533fdc3fdc97a95676bc84b8261e4e8
                                                                                    • Instruction Fuzzy Hash: ECD012A1C08109E9CB90A7D0DC45AF9B37EBB09301F508452FA0791440D624CF4AEF61
                                                                                    Function 006E2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006E236C
                                                                                    • PostMessageW.USER32(00000000), ref: 006E2373
                                                                                      • Part of subcall function 006BE97B: Sleep.KERNEL32 ref: 006BE9F3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FindMessagePostSleepWindow
                                                                                    • String ID: Shell_TrayWnd
                                                                                    • API String ID: 529655941-2988720461
                                                                                    • Opcode ID: 687ff6e310d467efc4af5bdf133128c92cbbf935d5f8e63a75933bfe4d5fa91b
                                                                                    • Instruction ID: 5f3d565a9eac5deb7191a27e9c9b934387eb1960e88cef1cd1a8db17c54cc193
                                                                                    • Opcode Fuzzy Hash: 687ff6e310d467efc4af5bdf133128c92cbbf935d5f8e63a75933bfe4d5fa91b
                                                                                    • Instruction Fuzzy Hash: FFD0C976381350BAE7A4B7709C4FFC666169B04B20F0059167645AA1D0C9A4B8468A58
                                                                                    Function 006E2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006E232C
                                                                                    • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 006E233F
                                                                                      • Part of subcall function 006BE97B: Sleep.KERNEL32 ref: 006BE9F3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: FindMessagePostSleepWindow
                                                                                    • String ID: Shell_TrayWnd
                                                                                    • API String ID: 529655941-2988720461
                                                                                    • Opcode ID: 486882e0b3a79e8230b04dce0e4f0aad5bb4ca945c738548edc51b443ab62f50
                                                                                    • Instruction ID: 95e40ef9d03fda6543f9d6e311548f4b57c13384d782e8968097984b7c98abe2
                                                                                    • Opcode Fuzzy Hash: 486882e0b3a79e8230b04dce0e4f0aad5bb4ca945c738548edc51b443ab62f50
                                                                                    • Instruction Fuzzy Hash: 24D0C976395350BAE7A4B7709C4FFC66A169B00B20F0059167645AA1D0C9A4A8468A54
                                                                                    Function 0068BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0068BE93
                                                                                    • GetLastError.KERNEL32 ref: 0068BEA1
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0068BEFC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1656341630.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true
                                                                                    • Associated: 00000000.00000002.1656326949.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.00000000006EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656399667.0000000000712000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656485759.000000000071C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                    • Associated: 00000000.00000002.1656502175.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_650000_file.jbxd
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$ErrorLast
                                                                                    • String ID:
                                                                                    • API String ID: 1717984340-0
                                                                                    • Opcode ID: 89e9ccdfcf974513cd4b831abbc02b9ca8248abd17bc0d0e9cf4206d495d0402
                                                                                    • Instruction ID: 2be00bf0237ff22184ef86c57c9d9ab08fecc55d0ab715a08b70e5eae0df363b
                                                                                    • Opcode Fuzzy Hash: 89e9ccdfcf974513cd4b831abbc02b9ca8248abd17bc0d0e9cf4206d495d0402
                                                                                    • Instruction Fuzzy Hash: E441FA35604206AFCF21AF64CC48AFA7BA7EF41360F249269FA595B2A1DB308D01CB50